FAQ

Does it need a model key?

No. A missing key is a complete local agent, not a trial. Plumbing steps never call a model, and a reasoning step with no provider configured resolves to judgment rather than to a model call. Add a key when you have a step that genuinely needs interpretation.

Which models and providers work?

Anthropic, OpenAI, Google, and any OpenAI-compatible endpoint (Ollama, LM Studio, a gateway). Policy and agent YAML never name a model; they name a tier, fast or capable, and the adapter for your provider maps the tier to a model. Override the mapping with LLM_MODEL_FAST and LLM_MODEL_CAPABLE. One provider is active at a time.

Can I run two tenants on one deployment?

No. The isolation unit is one deployment per tenant: one process, one SQLite file, one set of agents. There is no multi-tenant schema and none is planned for launch. Two tenants means two containers with two volumes, or two hosts each embedding the SDK.

Can I run two agents?

Yes. Each is a folder under domains/, and work is routed by work_type. If two agents claim the same work type, the first folder by name wins and doctor warns. Use ENGINE_LIVE_AGENTS to scope the console to the agents in use.

How is it licensed?

Razoo is proprietary software. The repository is private and the source is never distributed: every tier is a commercial licence for packaged software, the appliance as a container image and the SDK as a tarball, and embedding it in a product you sell requires the separate Embed agreement. The SDK is not on the npm registry. Details on the licence section of the security page.

What happens when a rule is wrong?

Two things, depending on the kind of rule. An authored rule in rules/*.yaml is yours to edit; the next replay reports the edit against every decision it touched. A learned pattern is revoked on drift or counterexample: it stops firing in every process, with no deploy. Retire makes that permanent. Nothing that was queued is dropped; the work goes to the next rung or to a person. See How authority is earned.

Does it phone home?

No content ever leaves your tenant. Today there is one setting, ENGINE_TELEMETRY, default off, and even when on the code builds an aggregate object in memory and has no transport to send it. The only outbound traffic is to the model provider you configured and the connectors you mapped, all of which are logged as decisions or facts.

Licensed installs report decision counts only, for billing (licence id, installation id, kernel version, governed decisions this month). Air-gapped sites send a signed monthly usage file instead.

Can it send email without Gmail?

Yes. Gmail, IMAP (reading), SMTP, and Microsoft 365 (Graph, reading and sending) are all registered transports behind one interface; doctor accepts an IMAP+SMTP pair or Microsoft 365 as a complete email connector. A confirmed send with no transport configured still fails closed: the outbox retries and then dead-letters rather than pretending. Chat replies can also go out through Telegram, WhatsApp, or a generic outbound webhook.

What is money_legal?

A sensitivity you put on a field in fields.yaml, or a flag on an action in actions.yaml. Anything that touches it needs a person to confirm, regardless of how confident a model or a pattern is. Such fields are never used as learning features and never auto-confirmed. It is the one rule with no override.

How do I revoke a pattern?

On the patterns page: Retire (or Disable, same path). It takes effect immediately across every process, and the signature is refused if learning ever rediscovers it. Or do nothing: a pattern is revoked on drift or counterexample and stops firing on its own. From any decision a learned pattern produced, "This was wrong" is a one-click revoke with a required reason; the SDK exposes it as revokeDecision(decisionId, actor, correctChoice, reason).

Can my own product drive the whole loop?

Yes, today, through @engine/sdk: submit, propose, confirm, drain, explain, plus resolving a judgment item (nextWork, resolveWork), dismissing or editing a staged action, and listing staged rows, work, decisions, and patterns with cursor pagination. See the SDK reference for the full surface.

Is there a hosted version?

Not yet. Appliance and above run on your infrastructure by design, and stay there until an independent audit exists. Hosted accounts for the Trial, Solo, and Starter tiers, and hosted Observe, open with the account portal on the launch plan. Until then, contact us for a hosted trial.

Is there a login?

Yes. OIDC login through your identity provider gates the console, with viewer, approver, and admin roles on every route. ENGINE_AUTH=local is a loopback-only alternative for a single operator's own machine and refuses any request that does not originate from 127.0.0.1. Hosted mode is the default; without OIDC configured the app refuses to start rather than serve unauthenticated.

Does it work with my agent framework?

If your framework can call a TypeScript function or POST JSON, yes. LangGraph, CrewAI, a homegrown loop, or a forty-line script: the agent proposes, the kernel stages, a person confirms. Razoo does not replace the framework and does not need to be the thing that calls the model. The proxy in Observe needs no integration at all.