The sidecar

If you have used a service mesh, you know the pattern: a small process runs next to your application, in the same pod or host, and watches its traffic without the application having to cooperate. Envoy does this for HTTP. The Kaizen sidecar does it for agent actions.

It is the Observer plus the egress collector, packaged to run right beside your agent. The agent's egress is routed through it, so it sees the real connections the agent makes, not just what the agent reports. It is how you reach the ground-truth attachments in observation depth.

The Kaizen Sandbox

The strongest form of the sidecar runs the whole decision inside a microVM in your own tenant, with your own model key, so only the verdict ever leaves. See the Kaizen Sandbox.

What it is

Two processes, in your environment:

• The egress collector sits in the network path and captures the agent's real outbound connections.
• The Observer evaluates each action against the learned baseline and your declaration, and (when enabled) runs the reasoning check with your own model key.

Your agent, the collector, the Observer, and your database all sit inside your tenant. The managed control plane only ever receives verdicts.

How a request flows

The agent makes a call, the collector observes it, the Observer decides, and the action proceeds or is blocked. Only the verdict leaves your tenant.

What you run

A Docker Compose brings up both processes next to your agent:

export TENANT_DATABASE_URL=postgres://...   # your own Postgres
export KAIZEN_ENC_KEY=...                    # your encryption key
export KAIZEN_API_KEY=kz_live_...
docker compose up -d

Process	Port	Role
Egress collector	8080	the agent's HTTPS_PROXY points here
Observer	8000	the control plane's OBSERVER_URL points here

Then:

1. Point your agent at the collector: export HTTPS_PROXY=http://<host>:8080.
2. Point the control plane at the Observer: OBSERVER_URL=http://<host>:8000.
3. Set your reasoning model under Settings, Reasoning model (bring your own key).

What stays in your tenant

Raw actions, the action sequence, and the model call never leave. Only the verdict crosses the boundary: allow or block, the reason (for example undeclared), and the reasoning check's severity, reasoning, and confidence.

Next to a self-hosted sandbox

The OpenAI Agents SDK lets you bring your own container for code execution (DockerSandboxClient, or a self-hosted runtime). That sandbox is where the model's generated code actually runs, the riskiest part. Run the sidecar beside it and route the sandbox's egress through the collector, so Kaizen observes the real connections that code makes and the reasoning check weighs them against the agent's declared purpose.

When to use the sidecar

Use	When
SDK or framework adapter	you want a one-line start, and cooperative visibility is enough
Sidecar	you need ground truth: the real connections, observed out of band, where the agent cannot route around you

You can start with the SDK and move to the sidecar later without changing your code. The Observer and the verdict contract are the same.