Describe the system you need. Governed agents build it.
DXMachine generates complete business applications from a structured spec: related data, forms, state machines, reports, dashboards and value streams. Every change is authorized, attested and reversible.
The AI agents that do the building work under the same identity, approval and audit rules as your people. When an examiner asks who changed a rule, on whose authority and when, the answer is already on the record.
Under development DXMachine is not yet generally available. We are building it with a small development advisory of regulated organizations. See where it stands →
Agents are joining your workforce. Give them an organization.
Every workforce has always needed the same things: a building with a front desk, roles and sign-off authority, institutional memory, honest books, and the work itself. An agent workforce needs them too. General Reasoning provides each one as a single governed operating model, and DXMachine is where the work happens.
Every layer follows the same rule, set out in the CRC standard we publish: fewer surfaces, fewer edges, and no edge crossed without authority. Why edges matter →
Everything a business application needs, generated and governed
Most organizations run their regulated processes in spreadsheets, shared inboxes and one-off database apps that nobody can audit. DXMachine replaces them with real applications built on one governed foundation.
Related records, done properly Working
Parent and child records at any depth, lookups and composite keys. Uniqueness and referential integrity are enforced when a record is saved, not left to a cleanup job.
A forms designer Working
Layouts, validation, and child records shown inline on the parent's form. Form designs are versioned, so changing a form is a recorded event, not a silent edit.
State machines Next
Every record type has explicit states and allowed transitions. Each transition carries its own role requirements, approvals and evidence.
How transitions work →Reports and dashboards Planned
Queries, summaries and live views, including kanban and flow boards driven directly by record state, so the board can't drift from the data.
Value streams Next
Governed pull from investment to release, with WIP limits, aging controls and gate reviews.
How work flows →Stop the line Working
Andon controls halt an application, a route or an agent instantly. Stopping and restarting are both attested events.
Working running in development builds · Next the current build stage · Planned scheduled after it. Roadmap →
State machines are the rules, not a diagram of them
In most platforms a process flow guides the user through a screen, and the underlying record can still be edited into any state. In DXMachine the state machine is enforced at the record. A transition that isn't defined can't happen, whether it comes from the form, the API or an agent.
| Transition | Who may make it | What must be true | Result |
|---|---|---|---|
| Received → Triaged | Intake analyst | Classification code assigned | Allowed · attested |
| Triaged → Investigating | Supervisor | Named investigator assigned | Allowed · attested |
| Investigating → Resolved | Investigator. An agent may draft findings; a human signs. | Findings and evidence attached | Allowed · attested |
| Resolved → Closed | Principal, never the investigator | Customer response sent | Allowed · separation of duties checked |
| Investigating → Closed | No one | Transition not defined | Refused · refusal recorded |
Because the lifecycle is data rather than code, it is versioned like everything else. You can see exactly which rules were in force on the day a record moved, and a change to the rules goes through its own approval.
Generate it with a wizard. Keep changing it for the life of the app.
The App Configurator works the same way as our Industry Configurator: a short guided wizard. It starts from the industry personality you already built, so the processes you selected become candidate applications and your terms become the names. You describe what the app has to do, governed agents draft the specification, and you review it before anything runs.
Review the spec the agents drafted
The spec is a readable record of what the app will be: each row declares a table, a relationship, an index, a state, a separation-of-duties rule or a report. Nothing is published until an owner has approved it.
| Kind | Name | Definition | Notes | |
|---|---|---|---|---|
| 1 | Hub | complaint | customer · account · received_at · channel · category | Primary record |
| 2 | Child | communication | complaint 1 → n · direction · sent_at · body | Shown inline on the complaint form |
| 3 | Child | remediation | complaint 1 → n · action · amount · approved_by | Requires approval to save |
| 4 | Index | complaint_unique | (customer, account, received_at) unique | Blocks duplicate intake |
| 5 | States | complaint.lifecycle | Received → Triaged → Investigating → Resolved → Closed | See transition rules |
| 6 | SoD | close_rule | closed_by ≠ investigated_by | Separation of duties |
| 7 | Report | aging | Open complaints by state × age bucket | Dashboard and kanban |
| 8 | Report | quarterly | Counts by category and product, per quarter | Regulatory statistical filing |
ComingThe App Configurator is our next release. Its first target is Chandra Passport, General Reasoning's own access product, which we are generating from a spec instead of hand-building.
The spec is where an app starts, not where it stops
Regulations change, and so do the processes built on them. Every mechanism used to generate a DXMachine app stays available inside it for as long as it runs. You don't regenerate the app or schedule a migration project. You change it in place, through the same approvals, and every version stays on the record.
Versioned forms and fields Working
Add or retire fields by publishing a new form version. Records keep the version they were captured under, so upgrading a form never requires a data migration, and old records still read exactly as they were entered.
Lifecycles and rules that evolve Next
States, transitions and separation-of-duties rules are versioned data. You can see which rules applied on the day a record moved, and a rule change goes through its own approval.
Changes proposed, never slipped in
People or governed agents can propose a change to a live app. It arrives as a change set with a diff against the running version, and it takes effect only when a named owner approves it.
Agents build under the same rules as people
Every AI agent in DXMachine is a named principal with a bounded capability envelope. An agent can propose a schema change, draft a form or advance a work item, but only as far as its role allows, and through the same state machines and gates as everyone else.
Agents bolted onto a platform
- The agent borrows a user's session or a service account.
- Its changes look the same in the log as a human's, or don't appear at all.
- The platform's configuration can be changed by whoever administers it.
- After an incident, someone rebuilds what happened from logs.
Agents in DXMachine
- Each agent has its own identity, role and capability limits.
- Every action is attributed to the agent and to the human it acts for.
- Changes to the application itself pass through approval gates.
- What happened is on the chain at the moment it happens.
Work is pulled, not pushed
DXMachine began as a value stream manager, and flow still runs through the whole product. Strategy enters at the top and is vetted at each level before anyone commits capacity to it. Work is pulled into execution only when there is room, under strict WIP limits and aging controls, so nothing sits unseen in a queue.
Legacy agile tools
For exampleRally · Azure DevOps Boards · Jira
- Any status can be dragged to any other, and workflows drift from team to team.
- Portfolio planning is a separate product bolted on top.
- WIP limits are advisory, and aging work goes quiet in a column.
- Auditors ask for change evidence, and someone exports and assembles it by hand.
A governed backlog in DXMachine
- Epics and features move only through the transitions you define.
- Investment, portfolio, delivery and release run as one pull system.
- WIP limits and aging controls are enforced, not just displayed.
- Every change and gate decision is already attested evidence.
Branch out without losing your place
A work item can move sideways into a specialist board, such as an architecture decision or a legal review, and then return to the main flow with its position and history intact.
Decisions become records
Each gate review produces a decision record: who approved, what they saw and which guardrails were checked. The trail is ready for an examiner as it stands.
Alongside your ERP, not instead of it
You don't have to rip anything out. Keep your ERP and CRM as systems of transaction. Move the regulated processes that have to be proven, such as complaints, change control, inspections, exceptions and approvals, onto DXMachine, where every step is attested.
Processes over existing data
A DXMachine workflow can reference records that live in another system, and it attests every decision made about them.
PlannedConnectors for major ERP and CRM platforms
Start from your current model
Read an existing entity model into an App Configurator spec, then generate a governed version of it.
Planned
No lock-in at the base
The spec and the record are yours. The Chandra Protocol underneath is MIT-licensed and published as an open standard.
One application shape, repeated across regulated work
Most compliance software is the same few things over and over: a register, a lifecycle, approvals with separation of duties, expiry dates and evidence. DXMachine builds that shape once, properly governed, and generates it for each domain. These are the categories where it fits best.
Agile backlog and portfolio
A four-level backlog, WIP-limited kanban, epic and feature lifecycles, dependencies and gate decisions. Every change is attested, so the backlog doubles as change-control evidence for SOX and SOC 2.
Established toolsBroadcom Rally · Azure DevOps Boards · Jira and Jira Align
Change, incident and request
Change requests with approval boards and separation of duties, incidents, problems and service requests. Change management is a state machine with evidence gates, and auditors test it every year.
Established toolsServiceNow ITSM · Jira Service Management · BMC Helix ITSM
HR cases and employee lifecycle
Employee relations cases and investigations, onboarding and offboarding checklists tied to access, policy acknowledgments and leave approvals. Sensitive cases stay isolated by design.
Established toolsServiceNow HR Service Delivery · HR Acuity
Access requests and reviews
Access requests, certification campaigns and separation of duties. This is Chandra Passport's own admin plane, and the first application we are generating.
Established toolsSailPoint · Saviynt
Risk, issues and controls
Risk registers, issues and actions, control testing and policy attestation.
Established toolsOptro (formerly AuditBoard) · LogicGate · Archer
CAPA and change control
Corrective actions, nonconformances and change control are state machines with evidence gates.
Established toolsOctave Reliance (formerly ETQ) · MasterControl · TrackWise
Incidents and corrective actions
Incident, investigation, action and verification, with every step attributed.
Established toolsIntelex · Cority · Enablon
Attestations and disclosures
Annual attestations, conflicts of interest, gifts and entertainment, and outside activity disclosures.
Established toolsMyComplianceOffice · StarCompliance
Vendor management
Vendor registers, questionnaires and periodic reviews with expiries.
Established toolsNcontracts (incl. Venminder) · OneTrust
By domain
The regulatory domains below are already modeled in the Industry Configurator, and the operational domains (project management, IT service management and HR) need no regulatory model at all. For each one we list the established tools in that category, and just as deliberately, what stays in your existing systems: DXMachine governs the regulated process and leaves the systems of transaction where they are.
| Domain | Applications DXMachine generates | Established tools in the category | Stays in your existing systems |
|---|---|---|---|
| Financial services In beta at BlackRock | |||
| FINRA / SEC advisers | Complaints log (Rule 4530); gifts and entertainment; outside business activity and private securities transaction disclosures; annual attestations; marketing review approval; branch inspections | MyComplianceOffice; StarCompliance; ComplianceAlpha (ACA); Red Oak; RegEd | Communications archiving; trade surveillance |
| FFIEC banking | Vendor management; complaint management; policy management; exam findings tracking | Ncontracts (incl. Venminder); Wolters Kluwer | Core banking; AML transaction monitoring; loan origination |
| SIFI / G-SIB | One bounded module, such as issues and actions, policy attestation or regulatory change, run as a pilot | Archer; MetricStream; IBM OpenPages; ServiceNow IRM | Enterprise-wide GRC platform |
| Lloyd's syndicates | Delegated-authority audit findings and remediation; regulatory attestations | — | Placement, claims and market accounting |
| Conglomerates / sovereign wealth | Portfolio-level issues and actions; policy attestation; subsidiary certifications | Archer; MetricStream; Diligent (entity management) | Consolidation and financial close |
| ASC 606 | Contract review and five-step judgment memos with approvals | No direct equivalent; revenue engines sit beside it | Revenue calculation engines |
| Healthcare and life sciences | |||
| HIPAA | Access-request log; BAA register; breach incident workflow; risk analysis register; training attestations | Compliancy Group; Clearwater | Electronic health records; access-log analytics (e.g. Imprivata FairWarning) |
| Joint Commission / CMS | Policy management and attestation; incident and event reporting; credentialing with expirations; survey readiness | NAVEX One PolicyTech; RLDatix; symplr | Clinical systems |
| Hospital compliance program | Hotline cases and investigations; conflict-of-interest disclosures; compliance committee actions; OIG exclusion screening (with governed data feeds) | NAVEX One | The exclusion databases themselves |
| Controlled substances / DEA | Diversion investigations; discrepancy resolution; theft-and-loss (DEA Form 106) case tracking; waste-witness exceptions | BD HealthSight Diversion Management; Imprivata diversion analytics | Dispensing cabinets and their surveillance analytics |
| Clinical laboratory / CLIA and CAP | QC failures and corrective action; proficiency testing results; personnel competency assessments; procedure sign-off | MediaLab (Vastian) | Laboratory information system; instruments |
| Health plans / Medicare Parts C and D | Grievances; coverage determinations and appeals against CMS timeliness rules; delegated-entity oversight; program audit universes | Inovaare; Mirra Health Care | Claims adjudication; enrollment |
| FDA / 21 CFR Part 11 | CAPA; deviations; change control; complaints, with the attributed, immutable records Part 11 asks for | Veeva Vault QMS; MasterControl; TrackWise (Honeywell); Octave Reliance (formerly ETQ) | Validated systems, until our computer system validation package is published |
| Medical devices / QMSR and ISO 13485 | Complaint handling with MDR reportability decisions; CAPA; design review and design history file approvals; supplier controls | Greenlight Guru; MasterControl | PLM and CAD; ERP |
| Clinical research / GCP | Protocol deviations; delegation-of-authority log; site training records; monitoring findings and follow-up | Florence eBinders; Veeva SiteVault | EDC, randomization and CTMS |
| Energy, industry and government | |||
| Energy / NERC CIP | Access reviews; change tickets; incident response plan records; evidence binders | AssurX; Archer or ServiceNow configured for CIP | Device configuration monitoring |
| Mining / MSHA / ICMMIn beta at Newmont | Citations and abatement; incidents; permit register; tailings-standard evidence; corrective actions | Enablon (Wolters Kluwer); Intelex; Cority; Sphera; VelocityEHS | Operations telemetry |
| Manufacturing / IATF 16949 | CAPA; nonconformance reports; 8D; PPAP approval; supplier corrective actions; audits | Octave Reliance (formerly ETQ); MasterControl; Intelex | MES; high-volume statistical process control; PLM |
| FMCSA / DOT | Driver qualification files with expirations; inspection defect repair; clearinghouse query log; accident register | J.J. Keller Encompass; Tenstreet | ELDs and telematics |
| Municipal / state audit | Single-audit findings and corrective action plans; grant compliance; council approvals; tax appeal cases | Tyler Technologies; OpenGov | General ledger; tax billing |
| FedRAMP / CMMC | POA&M tracking; control narratives; monthly continuous-monitoring submissions; evidence collection | Telos Xacta; RegScale | Automated cloud scanning |
| Technology, operations and risk | |||
| SOC 2 | Manual control tracking; policy attestation; vendor reviews | Vanta; Drata; Secureframe | Automated evidence from cloud, identity and code platforms |
| IT risk | Risk register; control testing; issue remediation; vendor questionnaires | Optro (formerly AuditBoard); LogicGate; Archer; ServiceNow IRM | Little. A strong fit end to end |
| IT service management | Change requests with approval boards and separation of duties; incidents and problems; service requests; change-control evidence for SOX ITGC | ServiceNow ITSM; Jira Service Management; BMC Helix ITSM | CMDB and discovery; monitoring and observability |
| Human resources | Employee relations cases and investigations; onboarding and offboarding tied to access; policy acknowledgments; leave approvals | ServiceNow HR Service Delivery; HR Acuity | HRIS and payroll |
| Project management / agile portfolio | Portfolio and program backlog from investment to release; kanban with WIP limits and aging; epic and feature lifecycles; dependency tracking; quarterly planning; gate decision records; change-control evidence | Broadcom Rally; Azure DevOps Boards; Jira and Jira Align | Source control; CI/CD pipelines; code review |
Product names identify the category DXMachine competes in and are trademarks of their respective owners. No affiliation or endorsement is implied.
How DXMachine compares
Enterprise suites and low-code platforms are excellent at breadth. DXMachine is built for the part they can't do: proving to an examiner that the application, its rules and every action taken in it were authorized and unaltered.
| Typical enterprise suite or low-code platform | DXMachine | |
|---|---|---|
| How apps are built | Low-code designers, increasingly with AI assistance | Generated from a declarative spec by governed agents, and approved at a gate |
| Record lifecycle | Process flows that guide the screen. Records can often be edited around them. | State machines enforced at the record, whatever the entry point |
| Audit | Audit logs, often administered by the same team they audit | Hash-chained attestation of both data changes and application changes |
| AI agents | Assistants acting through user or service credentials | Agents as principals with their own grants, and every action attributed |
| Changing the app later | Schema changes become release projects with data migrations | Versioned forms and fields, changed in-app. Old records keep their version, with no migration |
| Deployment | The vendor's cloud | Your hardware or a dedicated instance |
| Existing systems | Consolidate onto the platform | Govern the regulated processes and leave the rest in place |
Reachability is not authority
An AI adversary doesn't attack one application at a time. It builds the whole graph of your systems, identities and data flows at once, and walks the edges between them. That is why every product in the General Reasoning stack follows the CRC standard (Consolidate, Reduce, Close): fewer surfaces, fewer edges, and every remaining edge governed.
What the market offers today
- Graph databases can restrict which relationships a role may read or traverse.
- Attack-path tools map how an intruder could move, so you can see the risk after the fact.
- Agent gateways check a call at the perimeter, then trust whatever it reaches inside.
- Audit logs record what happened, in a store an administrator can change.
The General Reasoning stack
- Each organization and surface is isolated, so there are fewer edges to cross at all.
- Traversal is bounded by authority, edge class, depth and exposure, not just by what's reachable.
- Every crossing carries its grant, from the boundary gateway to the database query.
- Every crossing lands on a hash-chained record nobody can quietly edit.
The store of truth for everything
AletheiaGraph is both the stack's enterprise database (transactions, records, indexes and a native graph) and its reasoning engine, with inference and proof built in. It keeps stored, inferred and proposed facts distinct, so a conclusion is never mistaken for a record. Its query optimizer applies the CRC reachability model before cost: it chooses the cheapest plan that is permitted, not just the cheapest plan. At v1, AletheiaGraph becomes the storage engine for the entire stack, DXMachine applications included. The apps you generate inherit attested storage and governed traversal without a line of security code. aletheiagraph.com →
Where DXMachine stands
DXMachine is under development, and we would rather tell you exactly where it stands than oversell it. It runs on Chandra Enterprise, which is in beta with customers today. Each stage below makes a wider set of applications credible.
Registers and logs Working
Forms, composite indexes and validation triggers. Enough for complaint logs, gift registers, BAA registers and citation logs.
Governed workflow Building
State transitions, references between records, quorum approvals, separation of duties, a scheduler and kanban. This stage unlocks every domain above, starting with Passport.
Full platform Planned
Reporting and dashboards on AletheiaGraph, notifications and SLA timers, and governed connectors for identity sync and external data feeds.
Pricing you can model
The same three line items as the rest of the General Reasoning stack.
Platform fee
The governed stack, deployed on your hardware or a dedicated instance.
Application definition
A one-time fee for each regulated workflow or application configured for your organization.
Active engagements
A per-engagement fee that scales with the work you run, not with headcount.
Join the development advisory.
We're working with a small group of compliance, risk and quality leaders in regulated organizations. Bring the process you can least afford to get wrong. We'll specify it with you, you review early builds, and your process becomes one of the first applications DXMachine generates.