Observation depth
Every agent does two separate things: what it reports (its stated intent) and what it does (the actions with real effects). Kaizen only ever decides on what it does. It does not trust the model's narration, because generated text can be wrong or deliberately misleading.
The harder question is how much of the doing you can actually see, and how hard it is for an agent to do something you cannot see. That is set by where you attach Kaizen.
What the agent reports vs what it does
- What it reports is tokens: "I'll look up the order." That is not evidence.
- What it does is the side effect: the tool that actually ran, the connection that actually opened, the data that was actually touched.
The deeper you observe, the closer you get to what the agent does, and the less room it has to report one thing and do another.
The Kaizen Sandbox
The deepest rung is the Kaizen Sandbox: the whole decision runs inside a microVM in your own tenant, with your own model key, and only the verdict ever leaves. See the Kaizen Sandbox.
Where you can attach
| How you attach | What it observes | Can the agent act around it? | Effort |
|---|---|---|---|
SDK inspect() in-process |
only what you route through it | yes, it is cooperative | trivial |
| Framework adapter (OpenAI Agents, LangChain, CrewAI, Semantic Kernel, LlamaIndex, Pydantic AI, Vercel) | every tool call and its real arguments | partly; non-tool paths are invisible | one line |
| MCP shim (proxy in front of the server) | every MCP call on the wire, language-agnostic | hard, if MCP is the only tool path | a proxy in front |
| Egress proxy (network) | the real outbound connections and payloads | hard; all egress is routed through it | network config |
| In-tenant collector (eBPF / sandbox) | actual syscalls, connections, files | no; it sits below the agent, out of band | a collector in your runtime |
The lighter attachments observe what the agent reports through the path you handed it. The deeper ones observe what the machine actually did, and the agent cannot opt out, because the collector sits underneath it.
Where your agent runs
How deep you can attach depends on how much of the agent's environment you control. You cannot put a kernel probe inside a managed SaaS agent.
| Where the agent runs | What you can observe | How |
|---|---|---|
| You build and host it (your containers, VMs, Kubernetes) | real syscalls, files, connections | an in-tenant collector (eBPF / sandbox) |
| You control its network, not the host | the real outbound connections and payloads | an egress proxy, no kernel access needed |
| Fully managed SaaS (Copilot, Agent 365, a third-party agent) | what the platform exposes | the platform's audit or event API |
For most teams the practical deep layer is the egress proxy: it captures the actual connections an agent makes and works anywhere you can route its traffic, without kernel privileges. The in-tenant collector is the strongest option, reserved for runtimes you fully control. For a fully managed SaaS agent you observe the platform's own record of what it did, which is the ceiling there.
Both ground-truth options, the egress proxy and the in-tenant collector, are delivered by the sidecar that runs next to your agent. Kaizen observes at the deepest layer your agent's environment permits, and tells you which layer that is. To deploy the egress layer, see the Egress proxy.
Same Observer, however you attach
The Observer and the verdict contract do not change with depth; you only change how actions reach them. So you can start light, a framework adapter in minutes, and deepen to the sidecar later without re-platforming. The on-ramp and the strong form are the same product.
Match the depth to the stakes
Be clear about what each depth gives you:
- A cooperative attachment (SDK, framework adapter) gives you visibility and behavioural baselines. It is excellent for understanding and alerting, but an agent that wants to evade can act outside the path you instrumented.
- A chokepoint attachment (MCP shim, egress proxy) sees everything that flows through one funnel.
- A ground-truth attachment (eBPF, sandbox) observes the real effects out of band and cannot be evaded.
Your assurance is exactly as strong as your observation depth. Match the depth to the consequence.
The gap is the signal
The strongest signal comes from having both views at once. When Kaizen knows the agent's declared action and the actual effect, the gap between them is the alarm. The agent reports that it is querying the orders database; the collector observes a connection to an unfamiliar address. You do not infer intent, you measure the distance between what was claimed and what happened. A model can narrate anything; it cannot make a packet arrive somewhere other than where it actually goes.