A decision firewall for AI-agent actions — decided on impact, not identity
Govern agents you don't own — the documentation¶
Reeflex governs what an AI agent may do to your systems — before it happens. It decides on the impact an action would actually have (how reversible, how wide its blast radius, whether it reaches outside your system) and on everything the session has already done — not just whether the caller is allowed. On any backend, and deterministically: same action in, same decision out (zero LLM in the decision path).
Or try a real decision in 30 seconds — one curl, no install.
Where to go¶
-
Get started
Install an adapter and watch Reeflex hold a destructive action in minutes — Claude Code, n8n, WordPress, or an existing MCP server. Observe-mode first, so nothing breaks.
-
Concepts
The Action Envelope, the five rules, allow / hold / deny, the fail-closed invariant, sessions and anti-fragmentation, and HIL / HOTL / AIL.
-
Adapters
An adapter turns a backend action into an Action Envelope and enforces the verdict. Claude Code, WordPress, n8n, MCP gateway — or write your own against the spec.
What Reeflex is, in 30 seconds¶
An AI agent can now write to your database, edit your store, send your emails. Reeflex sits at that boundary. Every write is intercepted, normalized into a universal Action Envelope (verb + three risk axes + magnitude + session), and evaluated by an OPA/Rego policy that asks a sharper question than "is this user allowed?" — it asks "is this action safe, given the impact it would actually have?" The answer is one of three:
- allow — the action proceeds.
- hold — it waits for an approver you trust (a human, or an agent you trust — HITL / AIL).
- deny — it is blocked, with a reason the agent can read.
Because the engine reasons over the whole session, splitting one destructive action into many small ones buys nothing — it is the cumulative impact that is judged, not each call in isolation. That per-session memory is the core of the model.
Determinism is how you can trust it: the engine runs on OPA/Rego plus classical logic — no LLM, no network, no wall-clock in the decision path — so the same action always yields the same decision, auditable and reproducible. If the engine is unreachable it fails closed: nothing goes through.
We publish what it does not catch
A governance tool you can trust is one that tells you where it stops. Reeflex documents what the base policy does not catch up front — a first-class page, not an appendix.
This is documentation, not the marketing site
For the product pitch, see reeflex.io. These docs are the reference: concepts, architecture, adapters, policy, operations, compliance, and the REST API — organized from the honest content already in the repository.
New here? Start with Getting started. Common questions are in the FAQ; what's shipped vs planned is on the Roadmap.