DXMachine · Under development · A General Reasoning product

Describe the system you need. Governed agents build it.

DXMachine generates complete business applications from a structured spec: related data, forms, state machines, reports, dashboards and value streams. Every change is authorized, attested and reversible.

The AI agents that do the building work under the same identity, approval and audit rules as your people. When an examiner asks who changed a rule, on whose authority and when, the answer is already on the record.

Under development  DXMachine is not yet generally available. We are building it with a small development advisory of regulated organizations. See where it stands →

Part of the General Reasoning stack

Agents are joining your workforce. Give them an organization.

Every workforce has always needed the same things: a building with a front desk, roles and sign-off authority, institutional memory, honest books, and the work itself. An agent workforce needs them too. General Reasoning provides each one as a single governed operating model, and DXMachine is where the work happens.

Every layer follows the same rule, set out in the CRC standard we publish: fewer surfaces, fewer edges, and no edge crossed without authority. Why edges matter →

Everything a business application needs, generated and governed

Most organizations run their regulated processes in spreadsheets, shared inboxes and one-off database apps that nobody can audit. DXMachine replaces them with real applications built on one governed foundation.

Data

Related records, done properly Working

Parent and child records at any depth, lookups and composite keys. Uniqueness and referential integrity are enforced when a record is saved, not left to a cleanup job.

Forms

A forms designer Working

Layouts, validation, and child records shown inline on the parent's form. Form designs are versioned, so changing a form is a recorded event, not a silent edit.

Lifecycle

State machines Next

Every record type has explicit states and allowed transitions. Each transition carries its own role requirements, approvals and evidence.

How transitions work →
Insight

Reports and dashboards Planned

Queries, summaries and live views, including kanban and flow boards driven directly by record state, so the board can't drift from the data.

Flow

Value streams Next

Governed pull from investment to release, with WIP limits, aging controls and gate reviews.

How work flows →
Control

Stop the line Working

Andon controls halt an application, a route or an agent instantly. Stopping and restarting are both attested events.

Working running in development builds · Next the current build stage · Planned scheduled after it. Roadmap →

State machines are the rules, not a diagram of them

In most platforms a process flow guides the user through a screen, and the underlying record can still be edited into any state. In DXMachine the state machine is enforced at the record. A transition that isn't defined can't happen, whether it comes from the form, the API or an agent.

Transition rules · written complaint record
TransitionWho may make itWhat must be trueResult
Received → TriagedIntake analystClassification code assignedAllowed · attested
Triaged → InvestigatingSupervisorNamed investigator assignedAllowed · attested
Investigating → ResolvedInvestigator. An agent may draft findings; a human signs.Findings and evidence attachedAllowed · attested
Resolved → ClosedPrincipal, never the investigatorCustomer response sentAllowed · separation of duties checked
Investigating → ClosedNo oneTransition not definedRefused · refusal recorded

Because the lifecycle is data rather than code, it is versioned like everything else. You can see exactly which rules were in force on the day a record moved, and a change to the rules goes through its own approval.

Generate it with a wizard. Keep changing it for the life of the app.

The App Configurator works the same way as our Industry Configurator: a short guided wizard. It starts from the industry personality you already built, so the processes you selected become candidate applications and your terms become the names. You describe what the app has to do, governed agents draft the specification, and you review it before anything runs.

Review the spec the agents drafted

The spec is a readable record of what the app will be: each row declares a table, a relationship, an index, a state, a separation-of-duties rule or a report. Nothing is published until an owner has approved it.

App Configurator · complaints-register · generated spec8 rows · awaiting review
KindNameDefinitionNotes
1Hubcomplaintcustomer · account · received_at · channel · categoryPrimary record
2Childcommunicationcomplaint 1 → n · direction · sent_at · bodyShown inline on the complaint form
3Childremediationcomplaint 1 → n · action · amount · approved_byRequires approval to save
4Indexcomplaint_unique(customer, account, received_at) uniqueBlocks duplicate intake
5Statescomplaint.lifecycleReceived → Triaged → Investigating → Resolved → ClosedSee transition rules
6SoDclose_ruleclosed_by ≠ investigated_bySeparation of duties
7ReportagingOpen complaints by state × age bucketDashboard and kanban
8ReportquarterlyCounts by category and product, per quarterRegulatory statistical filing

ComingThe App Configurator is our next release. Its first target is Chandra Passport, General Reasoning's own access product, which we are generating from a spec instead of hand-building.

The spec is where an app starts, not where it stops

Regulations change, and so do the processes built on them. Every mechanism used to generate a DXMachine app stays available inside it for as long as it runs. You don't regenerate the app or schedule a migration project. You change it in place, through the same approvals, and every version stays on the record.

Forms

Versioned forms and fields Working

Add or retire fields by publishing a new form version. Records keep the version they were captured under, so upgrading a form never requires a data migration, and old records still read exactly as they were entered.

Rules

Lifecycles and rules that evolve Next

States, transitions and separation-of-duties rules are versioned data. You can see which rules applied on the day a record moved, and a rule change goes through its own approval.

Agents

Changes proposed, never slipped in

People or governed agents can propose a change to a live app. It arrives as a change set with a diff against the running version, and it takes effect only when a named owner approves it.

Agents build under the same rules as people

Every AI agent in DXMachine is a named principal with a bounded capability envelope. An agent can propose a schema change, draft a form or advance a work item, but only as far as its role allows, and through the same state machines and gates as everyone else.

Agents bolted onto a platform

Trusted by default
  • The agent borrows a user's session or a service account.
  • Its changes look the same in the log as a human's, or don't appear at all.
  • The platform's configuration can be changed by whoever administers it.
  • After an incident, someone rebuilds what happened from logs.

Agents in DXMachine

Authorized per action
  • Each agent has its own identity, role and capability limits.
  • Every action is attributed to the agent and to the human it acts for.
  • Changes to the application itself pass through approval gates.
  • What happened is on the chain at the moment it happens.

Work is pulled, not pushed

DXMachine began as a value stream manager, and flow still runs through the whole product. Strategy enters at the top and is vetted at each level before anyone commits capacity to it. Work is pulled into execution only when there is room, under strict WIP limits and aging controls, so nothing sits unseen in a queue.

Legacy agile tools

For exampleRally · Azure DevOps Boards · Jira

Tickets that can say anything
  • Any status can be dragged to any other, and workflows drift from team to team.
  • Portfolio planning is a separate product bolted on top.
  • WIP limits are advisory, and aging work goes quiet in a column.
  • Auditors ask for change evidence, and someone exports and assembles it by hand.

A governed backlog in DXMachine

Flow with proof
  • Epics and features move only through the transitions you define.
  • Investment, portfolio, delivery and release run as one pull system.
  • WIP limits and aging controls are enforced, not just displayed.
  • Every change and gate decision is already attested evidence.
Z-boards

Branch out without losing your place

A work item can move sideways into a specialist board, such as an architecture decision or a legal review, and then return to the main flow with its position and history intact.

Gates

Decisions become records

Each gate review produces a decision record: who approved, what they saw and which guardrails were checked. The trail is ready for an examiner as it stands.

Alongside your ERP, not instead of it

You don't have to rip anything out. Keep your ERP and CRM as systems of transaction. Move the regulated processes that have to be proven, such as complaints, change control, inspections, exceptions and approvals, onto DXMachine, where every step is attested.

Govern

Processes over existing data

A DXMachine workflow can reference records that live in another system, and it attests every decision made about them.

PlannedConnectors for major ERP and CRM platforms

Import

Start from your current model

Read an existing entity model into an App Configurator spec, then generate a governed version of it.

Planned

Leave

No lock-in at the base

The spec and the record are yours. The Chandra Protocol underneath is MIT-licensed and published as an open standard.

One application shape, repeated across regulated work

Most compliance software is the same few things over and over: a register, a lifecycle, approvals with separation of duties, expiry dates and evidence. DXMachine builds that shape once, properly governed, and generates it for each domain. These are the categories where it fits best.

Project management

Agile backlog and portfolio

A four-level backlog, WIP-limited kanban, epic and feature lifecycles, dependencies and gate decisions. Every change is attested, so the backlog doubles as change-control evidence for SOX and SOC 2.

Established toolsBroadcom Rally · Azure DevOps Boards · Jira and Jira Align

IT service management

Change, incident and request

Change requests with approval boards and separation of duties, incidents, problems and service requests. Change management is a state machine with evidence gates, and auditors test it every year.

Established toolsServiceNow ITSM · Jira Service Management · BMC Helix ITSM

Human resources

HR cases and employee lifecycle

Employee relations cases and investigations, onboarding and offboarding checklists tied to access, policy acknowledgments and leave approvals. Sensitive cases stay isolated by design.

Established toolsServiceNow HR Service Delivery · HR Acuity

Identity governance

Access requests and reviews

Access requests, certification campaigns and separation of duties. This is Chandra Passport's own admin plane, and the first application we are generating.

Established toolsSailPoint · Saviynt

GRC

Risk, issues and controls

Risk registers, issues and actions, control testing and policy attestation.

Established toolsOptro (formerly AuditBoard) · LogicGate · Archer

Quality

CAPA and change control

Corrective actions, nonconformances and change control are state machines with evidence gates.

Established toolsOctave Reliance (formerly ETQ) · MasterControl · TrackWise

EHS

Incidents and corrective actions

Incident, investigation, action and verification, with every step attributed.

Established toolsIntelex · Cority · Enablon

Employee compliance

Attestations and disclosures

Annual attestations, conflicts of interest, gifts and entertainment, and outside activity disclosures.

Established toolsMyComplianceOffice · StarCompliance

Third-party risk

Vendor management

Vendor registers, questionnaires and periodic reviews with expiries.

Established toolsNcontracts (incl. Venminder) · OneTrust

By domain

The regulatory domains below are already modeled in the Industry Configurator, and the operational domains (project management, IT service management and HR) need no regulatory model at all. For each one we list the established tools in that category, and just as deliberately, what stays in your existing systems: DXMachine governs the regulated process and leaves the systems of transaction where they are.

DomainApplications DXMachine generatesEstablished tools in the categoryStays in your existing systems
Financial services In beta at BlackRock
FINRA / SEC advisersComplaints log (Rule 4530); gifts and entertainment; outside business activity and private securities transaction disclosures; annual attestations; marketing review approval; branch inspectionsMyComplianceOffice; StarCompliance; ComplianceAlpha (ACA); Red Oak; RegEdCommunications archiving; trade surveillance
FFIEC bankingVendor management; complaint management; policy management; exam findings trackingNcontracts (incl. Venminder); Wolters KluwerCore banking; AML transaction monitoring; loan origination
SIFI / G-SIBOne bounded module, such as issues and actions, policy attestation or regulatory change, run as a pilotArcher; MetricStream; IBM OpenPages; ServiceNow IRMEnterprise-wide GRC platform
Lloyd's syndicatesDelegated-authority audit findings and remediation; regulatory attestations—Placement, claims and market accounting
Conglomerates / sovereign wealthPortfolio-level issues and actions; policy attestation; subsidiary certificationsArcher; MetricStream; Diligent (entity management)Consolidation and financial close
ASC 606Contract review and five-step judgment memos with approvalsNo direct equivalent; revenue engines sit beside itRevenue calculation engines
Healthcare and life sciences
HIPAAAccess-request log; BAA register; breach incident workflow; risk analysis register; training attestationsCompliancy Group; ClearwaterElectronic health records; access-log analytics (e.g. Imprivata FairWarning)
Joint Commission / CMSPolicy management and attestation; incident and event reporting; credentialing with expirations; survey readinessNAVEX One PolicyTech; RLDatix; symplrClinical systems
Hospital compliance programHotline cases and investigations; conflict-of-interest disclosures; compliance committee actions; OIG exclusion screening (with governed data feeds)NAVEX OneThe exclusion databases themselves
Controlled substances / DEADiversion investigations; discrepancy resolution; theft-and-loss (DEA Form 106) case tracking; waste-witness exceptionsBD HealthSight Diversion Management; Imprivata diversion analyticsDispensing cabinets and their surveillance analytics
Clinical laboratory / CLIA and CAPQC failures and corrective action; proficiency testing results; personnel competency assessments; procedure sign-offMediaLab (Vastian)Laboratory information system; instruments
Health plans / Medicare Parts C and DGrievances; coverage determinations and appeals against CMS timeliness rules; delegated-entity oversight; program audit universesInovaare; Mirra Health CareClaims adjudication; enrollment
FDA / 21 CFR Part 11CAPA; deviations; change control; complaints, with the attributed, immutable records Part 11 asks forVeeva Vault QMS; MasterControl; TrackWise (Honeywell); Octave Reliance (formerly ETQ)Validated systems, until our computer system validation package is published
Medical devices / QMSR and ISO 13485Complaint handling with MDR reportability decisions; CAPA; design review and design history file approvals; supplier controlsGreenlight Guru; MasterControlPLM and CAD; ERP
Clinical research / GCPProtocol deviations; delegation-of-authority log; site training records; monitoring findings and follow-upFlorence eBinders; Veeva SiteVaultEDC, randomization and CTMS
Energy, industry and government
Energy / NERC CIPAccess reviews; change tickets; incident response plan records; evidence bindersAssurX; Archer or ServiceNow configured for CIPDevice configuration monitoring
Mining / MSHA / ICMMIn beta at NewmontCitations and abatement; incidents; permit register; tailings-standard evidence; corrective actionsEnablon (Wolters Kluwer); Intelex; Cority; Sphera; VelocityEHSOperations telemetry
Manufacturing / IATF 16949CAPA; nonconformance reports; 8D; PPAP approval; supplier corrective actions; auditsOctave Reliance (formerly ETQ); MasterControl; IntelexMES; high-volume statistical process control; PLM
FMCSA / DOTDriver qualification files with expirations; inspection defect repair; clearinghouse query log; accident registerJ.J. Keller Encompass; TenstreetELDs and telematics
Municipal / state auditSingle-audit findings and corrective action plans; grant compliance; council approvals; tax appeal casesTyler Technologies; OpenGovGeneral ledger; tax billing
FedRAMP / CMMCPOA&M tracking; control narratives; monthly continuous-monitoring submissions; evidence collectionTelos Xacta; RegScaleAutomated cloud scanning
Technology, operations and risk
SOC 2Manual control tracking; policy attestation; vendor reviewsVanta; Drata; SecureframeAutomated evidence from cloud, identity and code platforms
IT riskRisk register; control testing; issue remediation; vendor questionnairesOptro (formerly AuditBoard); LogicGate; Archer; ServiceNow IRMLittle. A strong fit end to end
IT service managementChange requests with approval boards and separation of duties; incidents and problems; service requests; change-control evidence for SOX ITGCServiceNow ITSM; Jira Service Management; BMC Helix ITSMCMDB and discovery; monitoring and observability
Human resourcesEmployee relations cases and investigations; onboarding and offboarding tied to access; policy acknowledgments; leave approvalsServiceNow HR Service Delivery; HR AcuityHRIS and payroll
Project management / agile portfolioPortfolio and program backlog from investment to release; kanban with WIP limits and aging; epic and feature lifecycles; dependency tracking; quarterly planning; gate decision records; change-control evidenceBroadcom Rally; Azure DevOps Boards; Jira and Jira AlignSource control; CI/CD pipelines; code review

Product names identify the category DXMachine competes in and are trademarks of their respective owners. No affiliation or endorsement is implied.

How DXMachine compares

Enterprise suites and low-code platforms are excellent at breadth. DXMachine is built for the part they can't do: proving to an examiner that the application, its rules and every action taken in it were authorized and unaltered.

Typical enterprise suite or low-code platformDXMachine
How apps are builtLow-code designers, increasingly with AI assistanceGenerated from a declarative spec by governed agents, and approved at a gate
Record lifecycleProcess flows that guide the screen. Records can often be edited around them.State machines enforced at the record, whatever the entry point
AuditAudit logs, often administered by the same team they auditHash-chained attestation of both data changes and application changes
AI agentsAssistants acting through user or service credentialsAgents as principals with their own grants, and every action attributed
Changing the app laterSchema changes become release projects with data migrationsVersioned forms and fields, changed in-app. Old records keep their version, with no migration
DeploymentThe vendor's cloudYour hardware or a dedicated instance
Existing systemsConsolidate onto the platformGovern the regulated processes and leave the rest in place
Software is getting cheap to build. Proof isn't. DXMachine makes the proof part of the build.

Reachability is not authority

An AI adversary doesn't attack one application at a time. It builds the whole graph of your systems, identities and data flows at once, and walks the edges between them. That is why every product in the General Reasoning stack follows the CRC standard (Consolidate, Reduce, Close): fewer surfaces, fewer edges, and every remaining edge governed.

What the market offers today

Pieces, bolted together
  • Graph databases can restrict which relationships a role may read or traverse.
  • Attack-path tools map how an intruder could move, so you can see the risk after the fact.
  • Agent gateways check a call at the perimeter, then trust whatever it reaches inside.
  • Audit logs record what happened, in a store an administrator can change.

The General Reasoning stack

One concerted design, out of the box
  • Each organization and surface is isolated, so there are fewer edges to cross at all.
  • Traversal is bounded by authority, edge class, depth and exposure, not just by what's reachable.
  • Every crossing carries its grant, from the boundary gateway to the database query.
  • Every crossing lands on a hash-chained record nobody can quietly edit.
At agent speed, unattested data is a breach waiting to happen. An agent can read, copy and act on an unrecorded write before anyone knows it exists. In the General Reasoning stack, nothing is saved without attribution, authority and a place on the record.
AletheiaGraph · v1 qualification

The store of truth for everything

AletheiaGraph is both the stack's enterprise database (transactions, records, indexes and a native graph) and its reasoning engine, with inference and proof built in. It keeps stored, inferred and proposed facts distinct, so a conclusion is never mistaken for a record. Its query optimizer applies the CRC reachability model before cost: it chooses the cheapest plan that is permitted, not just the cheapest plan. At v1, AletheiaGraph becomes the storage engine for the entire stack, DXMachine applications included. The apps you generate inherit attested storage and governed traversal without a line of security code. aletheiagraph.com →

Where DXMachine stands

DXMachine is under development, and we would rather tell you exactly where it stands than oversell it. It runs on Chandra Enterprise, which is in beta with customers today. Each stage below makes a wider set of applications credible.

Stage 1 · Today

Registers and logs Working

Forms, composite indexes and validation triggers. Enough for complaint logs, gift registers, BAA registers and citation logs.

Stage 2 · Next

Governed workflow Building

State transitions, references between records, quorum approvals, separation of duties, a scheduler and kanban. This stage unlocks every domain above, starting with Passport.

Stage 3 · Then

Full platform Planned

Reporting and dashboards on AletheiaGraph, notifications and SLA timers, and governed connectors for identity sync and external data feeds.

Pricing you can model

The same three line items as the rest of the General Reasoning stack.

1 · Platform

Platform fee

The governed stack, deployed on your hardware or a dedicated instance.

2 · Definition

Application definition

A one-time fee for each regulated workflow or application configured for your organization.

3 · Usage

Active engagements

A per-engagement fee that scales with the work you run, not with headcount.

See current pricing →

Join the development advisory.

We're working with a small group of compliance, risk and quality leaders in regulated organizations. Bring the process you can least afford to get wrong. We'll specify it with you, you review early builds, and your process becomes one of the first applications DXMachine generates.

jksmith@genreason.com