How it works

Hold a wrong action before it commits.

The gate sits on the routed surface — a payment rail or a commitment instrument — tiers each action against RAFCF, and returns a first-class HELD status in milliseconds, so a human decides without ever blocking the agent's thread.

The flow, step by step

One material action, from the agent's call to the recorded decision and its tie-out to the accounting entry.

01

Agent initiates a financial action

A commitment — approving an invoice, issuing a purchase order, changing a payee’s bank details — or a movement: a vendor payout, refund, or treasury transfer.

02

Reddix intercepts on the routed surface

The action is routed through Reddix at the point of execution — not scraped after the fact.

03

Risk-tiered against RAFCF tier 0–3

Reversibility and materiality decide the tier, drawn from the versioned Finality Registry. Tier 0–1 clear automatically; Tier 2+ is held. Unknown actions default to the higher tier and are flagged, never silently lowered.

04

Control reference assigned CO-1.3

A stable identifier is attached at classification and propagated into the executing instruction and the resulting accounting entry wherever each format permits.

05

HELD returned instantly

The agent receives a first-class HELD status in milliseconds and moves on — no open connection, no timeout.

06

Pushed to the controller's workspace

The held action surfaces for maker-checker review with full context: agent, counterparty, tier, amount.

07

Approve or reject, out-of-band

A human resolves it on their own time. On approval, Reddix releases the instruction. The approver is distinct from the initiator and mapped to your segregation-of-duties model.

08

Recorded to the tamper-evident ledger

The decision, the approver, and the true outcome — released, denied or expired — are hash-chained into the record. An expiry is never recorded as a human decision.

Why async matters

HELD is a status, not a stalled call.

The gate never lives inside the agent's tool-call thread. CO-3.3

First-class HELD
The pre-commit window is a durable state. The held action carries an identifier that survives the initiating request, so the agent’s thread is never blocked waiting on a human and a human is never rushed by an open connection. Callback, polling, queue or resumable session all conform — but a design that carries review time on an open connection converts a maker-checker control into an unattributed denial the moment it expires, and corrupts the record.

The three rungs, expanded

How each connects — and why adoption is easy, earned, or trust-gated.

Breaks nothing
Level 1 · Observe

Observe

How it connects: read-only — Reddix records and classifies every agent financial action, commitment and movement alike, with no code in your payment path.

Why it's easy: nothing changes for the agent. You see governed volume and tier distribution in your own numbers before committing to anything.

Opt-in, incremental
Level 2 · Gate

Gate

How it connects: material actions are routed through the inline gate, one surface at a time, with fail-open / fail-closed behaviour agreed per tier in advance.

Why it's earned: inline is opt-in and conformance is per-surface — you decide which surfaces and thresholds cross the gate, and expand as trust grows.

Trust-gated
Level 3 · Recover

Recover

How it connects: the inverse is registered at classification and executed on trigger; where no mechanism exists it degrades to prepare-and-instruct, then to documented claim.

Why it's last: it depends on a trusted gate and a proven record — turned on once the first two rungs have earned it.

Control without custody

The gate holds the instruction, never your money.

A normative design constraint, not an implementation preference. CO-3.4 · §8

What stays the same

Your banking relationships

Value remains with your organization and its existing financial institutions throughout. Reddix is never a counterparty to the movement and never a party to the funds — adopting the framework introduces no new institution into the flow of funds and creates no new counterparty exposure.

Why it matters

A control that holds funds changes its own character

A control plane holding an instruction and one holding money look similar in a product diagram and are entirely different in law, in risk, and in what an auditor must evaluate. An implementation that never receives, holds, or directs custody of value avoids the question — without weakening any control objective.

Scope honesty
What recovery is — and isn't
Recovery is per-surface and best-effort, never a universal undo. On instant or irrevocable rails there is nothing to claw back, and cancelling an accepted purchase order is a negotiation rather than a mechanism — so the pre-commit window is the product. Reversibility is a property of the rail, the counterparty, and the governing law, not of the framework. Reddix is candid about this because a controller would rather hear it now than discover it in a loss event.

Start with the exposure report.

Run Reddix at Level 1 in shadow mode for 30 days and see your governed volume, tier distribution and exposure in your own numbers — before anything goes inline.

Talk to us · founder@reddix.ai