An open standard for governing what AI agents do with money: how to record each action, tier it by how reversible it is, hold the material ones for approval, and recover value where a mechanism exists. RAFCF covers any agent-initiated instruction that creates, alters, extinguishes, or transfers a financial obligation, a payment or a promise alike. It is neutral on rails and vendors, so a level can be reached in-house, with any bank, processor or product, or a combination of them. Finance, audit, risk and insurance functions get one vocabulary to cite in their own templates.
This page is a reader’s summary. The PDF is the specification itself — every clause, the per-rail finality mapping in §3, the materiality matrix in §6.1, and Appendix A. Cite the PDF, not this page.
Published under CC BY 4.0. Conformance may be claimed by any organization without permission or fee. Requirement levels use RFC 2119 keywords, the standards convention for how binding a line is: MUST is required, SHOULD is expected unless you can justify otherwise, MAY is permitted.
Every agent financial action is assigned exactly one tier. Tiers are ordinal: the higher the number, the less recoverable the action is once committed, and so the more prevention it needs beforehand. Both classes of action sit on this one scale, but a different property fixes where each lands, so the examples below are split by class.
Control posture: log, register the inverse, allow. Undo at no cost and without counterparty cooperation. In plain terms: you can reverse it yourself, straight away, and nobody else has to agree to it.
Commitment: draft or unissued documents. Movement: processor-internal transfers, pre-capture card auths, internal ledger entries.
Control posture: arm compensation at classification; execute on trigger. Recoverable via a defined mechanism within a bounded window and reason list, or unilaterally rescindable before counterparty reliance. In plain terms: there is a real way to get the money back, but only inside a time limit and only for accepted reasons. Or you can still call the commitment off, so long as the other side has not yet acted on it.
Commitment: credit memos, cancellation of an unaccepted order. Movement: card refunds, ACH reversals within window.
Control posture: manufacture a window, meaning maker-checker approval above a threshold before the action is released. No reliable post-commit undo; recovery depends on a counterparty’s cooperation. In plain terms: once it is done, getting the money back depends on someone else agreeing to help, so the pause beforehand is the only protection you control.
Commitment: accepted purchase orders, approved invoices, vendor bank-detail changes. Movement: instant rails, wires.
Control posture: prevention only. Block it, or require approval before signing. No recovery primitive exists at all. Never promise undo. In plain terms: nothing reverses this once it is done, and any product that implies otherwise is misleading you.
Commitment: executed contracts with no unilateral exit. Movement: on-chain settlement.
Classification is conservative by default. When in doubt, assume the action is the harder one to undo. Where an action's tier is uncertain, it MUST be assigned the higher (less reversible) tier until positively resolved. Automated classification MAY flag an unknown action for review but MUST NOT auto-lower a tier.
One tier scale governs both. For a movement, the tier follows the rail's finality law, how firmly that route treats a payment as done. For a commitment, it follows whether the organization can still withdraw unilaterally.
Each surface mapped to its finality reality, the recovery mechanism that actually exists, and the honest promise the framework permits you to make about it.
Written as auditable control statements in the COSO idiom, the form auditors already expect to read a control in, so an organization can assert each one and an auditor can test it. Conformance is defined against these four.
Everything is written down as it happens, in a log that can be added to but not quietly rewritten, and each entry carries a reference that lets an auditor follow it through to your accounts.
Nothing goes out before the system has decided how reversible it is and how much is at stake, and the reasoning behind that decision is kept so it can be reconstructed later.
Anything that matters stops and waits for someone other than the initiator to approve it. The wait is recorded state rather than an open connection, and an action that merely ran out of time is never written up as a decision.
If the action can be undone, the reversal is prepared in advance and fired when it is needed. If it cannot, the system says so plainly instead of implying the money is retrievable.
One standard shape for recording what went wrong, in money, so that one organization's losses can be compared with another's. Insurers moving into agentic risk have nothing like this to price against today.
The required control is a function of both. RAFCF fixes the structure of this matrix and the meaning of every cell; you fix the thresholds.
Postures cannot be compared without a denominator. Two organizations at identical conformance levels can be in entirely different positions: one gating a hundred million dollars is not where one gating a hundred thousand is. The number only means something beside the total.
Count an action when it is instructed, not when it settles. Where a payment discharges a commitment you already counted, count the commitment and reference the payment, never both. And always publish the scope beside the number, because a figure covering two rails is not comparable to one covering six. Organizations SHOULD report governed volume as a proportion of the total value of agent-initiated financial actions. That proportion, not the raw figure, is the honest measure of how much of the surface is actually under control.
Claiming a level is not enough. A conformant organization can produce, on demand, a posture attestation generated from the Record plane itself, never compiled by hand.
CO-1 and CO-2 met in shadow mode: every agent financial action is logged, tiered and given a control reference, with nothing held. This is what produces the exposure report.
Adds enforced maker-checker on material actions for the surfaces you route through, with durable holds and an agreed position, per tier, on what happens when the control plane is unreachable.
Adds compensation armed in advance, prepare-and-instruct recovery where no automatic reversal exists, and loss events captured to the schema in §5.
Conformance is per-surface and per-integration. An organization is conformant at a level for the surfaces and integrations it has actually put in scope, never across the board. A claim of "automated recovery" holds for one surface and one access path at a time, and every attestation has to state the scope it covers.
The organization makes the claim from its own records. Good enough for internal governance, board and audit-committee reporting, and vendor questionnaires. The default, and the floor.
Someone you deal with makes the assessment: a partner onboarding you, a platform admitting you, or a contractual assurance given from one party to another.
The level an external auditor or an insurance underwriter can rely on. Normative: the assessor MUST be independent of the organization and of any vendor in the assessed scope. Whoever supplies the controls cannot also vouch for them, so an attestation a product generates about itself is first-party evidence no matter how official the format looks.
A standard edited indefinitely by a single commercial implementer will be discounted by the parties whose reliance makes it worth having, and they will be right to discount it.
Seats are drawn from deploying organizations, audit practice and underwriting, and no more than one is held by the editor. If you run agent payments, audit them, or price the risk of them, put your hand up. Tell us where you think Draft 0.2 is wrong while you are at it — that is most of what the seat is for.
Would rather write? standards@reddix.ai — name, organization, role, and where you think the draft is wrong.
What is deliberately not promised: the editor does not undertake to give away the Finality Registry data feed or the reference implementation. Keeping a free specification separate from a commercially maintained live dataset is a legitimate structure, and saying so is better than implying a handover that is not coming.
Normative as to the Gate, informational as to everything else. It exists because the most consequential architectural choice open to an implementer is also the easiest one to make badly.
The Gate withholds release of an instruction. Value stays with the organization and its existing financial institutions throughout. The control plane is never a counterparty to the movement and never a party to the funds.
Same product diagram, different thing. The plane has interposed itself into the movement of value, which changes its regulatory character, its risk, and what an auditor must look at — without making any control objective here stronger.
For implementers, not for the standard to resolve. Whether a particular architecture, in a particular jurisdiction, triggers licensing or authorization obligations is a legal question requiring qualified advice on the specific facts. This framework neither answers it nor relieves anyone of asking it.
Comment on a single clause from the clause itself, or write to us about the draft as a whole — either way, cite the clause number. Every substantive comment gets logged and answered in public: accepted, accepted with modification, or declined, each with a reason, published alongside Draft 0.3. Comments are published with attribution: tell us who you are, where you work and what you do there. We do not log anonymous comments on the draft.
One email when Draft 0.3 publishes, carrying the disposition of every comment on 0.2. Nothing else, and we will take you off it the moment you ask.
Or run the controls on a real surface, and comment from there →