How Kaizen decides

Kaizen evaluates each action in two stages. Most actions are settled by a deterministic check; only the few that need judgment go to a model, in your boundary, with your key.

Stage 1: the deterministic check

Runs on every action. It compares the action to the agent's learned baseline and its declaration: a tool it has never used, a destination it has never connected to, anything it never declared. This is cheap, immediate, and does not raise false positives, so it is always on and it scales.

Stage 2: the reasoning check

Runs selectively, when Stage 1 flags something or at the end of a session. It takes the recent sequence of actions, the declaration, and the learned baseline, and answers a question a rule cannot: does this behaviour match what the agent is for? A single action is easy to check against a rule; a sequence weighed against a stated purpose needs a model.

It returns a verdict with its reasoning and a confidence, never a bare flag. Confidence is feed-aware: higher when the action came from a ground-truth source (the egress proxy or a sandbox), advisory when it came from a cooperative SDK hook an agent could route around.

Bring your own model

The reasoning check calls your model with your key. Configure it in the console under Settings, Reasoning model (provider, model, base URL, key). The key is encrypted at rest and never returned, and the check runs in your boundary; only the verdict leaves. Without a key, Kaizen runs Stage 1 alone.

You tune it in the same place: a budget (reviews per agent per hour, so cost cannot run away) and a confidence threshold for what gets surfaced.

Why two stages

An always-on model raises false positives; in testing it flagged a new database as malicious. So the deterministic check is the gate that never sleeps, and the model is reserved for the contextual, sequence-level questions where it is genuinely better than a rule. Stage 2 is asynchronous and fail-open: if the model is slow or down, Stage 1 still protects you.