Skip to content

Isolation and scale

How Kaizen isolates agents and tenants, and how it scales. These are the questions enterprise teams ask first.

Do you spin up a microVM for each agent?

By default, no. A throwaway microVM per agent per run would be expensive and would not scale. The lightweight default is two-tier:

  • Enforcement runs in-process, inside your agent, through the client. There is no server hop and no added latency. This is what scales to any volume, because there is no shared bottleneck on the hot path.
  • Behavioral judgment runs in one isolated Observer, shared across agents but boxed off from the host and network.

For teams that need the deepest isolation, the Kaizen Sandbox runs the whole decision inside a microVM in your own tenant: the raw behavior never leaves and only the verdict does. That is one isolated environment per deployment, not a throwaway VM per agent run. See the Kaizen Sandbox.

How is memory isolated?

Two layers:

  • Per agent. Each agent's behavioral profile is namespaced by an org:agent key in the profile store. Agent A's history is only ever retrieved with A's key, so it never mixes with B's.
  • Per tenant. Every key and record carries the organization id, and the control-plane database enforces row-level security per organization. One customer's data is invisible to another.

For teams that need physical separation, the Observer runs in your own environment, and we can provision a dedicated Observer and database so your behavioral data never shares infrastructure with anyone else.

Is it scalable?

  • The enforcement path scales trivially because it is in-process.
  • The behavioral check is asynchronous. It never sits on the agent's critical path, so it cannot slow the agent down.
  • The check is set-membership against a compact per-agent profile, not a similarity search, so there are no embeddings on the hot path. A read is one indexed lookup, and a familiar action costs no write at all. Memory is bounded to one small row per agent.

A write happens only while an agent is still learning its baseline, or when a genuinely new capability appears. A steady stream of familiar actions is free. The profile is keyed per agent and per tenant, so the store shards cleanly, and an enterprise can run a dedicated database for full single-tenant isolation with no code change.

Where can the Observer run?

The Observer definition does not change; only the runtime does. A local process for development, a container on your own infrastructure, or a hardened, single-tenant deployment in your environment. See Architecture.