The Observer

The Observer is Kaizen's decision engine. It learns what each agent normally does and flags the actions that do not fit, in your own environment. It decides in two stages, and can also block known-bad outright.

Stage 1: the deterministic check

The Observer keeps a per-agent profile of what each agent normally does. For the first several observations it simply learns; after that it compares each new action to the agent's baseline and to what you have declared.

It flags a genuine change in capability or intent:

• a kind of action the agent has never done,
• a tool it has never used,
• a source it has never used,
• a destination it has never connected to,
• an outbound connection it does not normally make,
• anything outside what you declared for it.

It deliberately does not flag minor variation, like a new account or database within the same kind of task. The decision is a deterministic capability-profile comparison, so every flag is explainable, and it is cheap enough to run on every action.

Stage 2: the reasoning check

When Stage 1 flags something, the Observer can escalate to a reasoning model that weighs the whole recent sequence against the agent's declared purpose, then returns a verdict with its reasoning and a confidence. It runs with your model and your key, only when needed. See how Kaizen decides.

Blocking known-bad (optional)

Separately, the Kaizen client can block clearly-bad actions in-process, before they run:

• Blocklist: block known-bad publishers, destinations, hashes, or tool patterns.
• Allowlist: allow only an explicit set; everything else is blocked.
• Correlation: catch dangerous sequences (for example, read sensitive data then connect out).

This path is local, fast, and fail-closed. Most teams start observe-only and add blocking where they have drawn a clear line.

Where it runs

The Observer runs in an isolated service, in your own environment, with one job over its boundary: an action goes in, a verdict comes out. Because it reads untrusted agent input, isolating it means a compromised observer can do nothing. With the reasoning check enabled in-tenant, even the model call and the raw action sequence stay inside your boundary; only verdicts leave.

Same Observer, any runtime

The same Observer runs as a local process in development, a container on your infrastructure, or a hardened MicroVM. The definition does not change, only where it runs. See The sidecar.