Connect a filter to its agent

A filter that sends whole events needs an agent in Kindo built to take them: the paired agent. Sift generates it for the filter. You choose its shape and answer two questions, then either let Sift create it in Kindo and pair it, or download it, import it yourself and paste its id back. Until it is paired, the filter cannot start scoring.

When you do this

Right after creating a filter, from Get the agent →.
When the Actions tab shows Connect its agent, Configure its agent or Regenerate the agent.
When you want the filter to send to a different agent: Settings › Delivery, under Agent.

A filter built on an existing agent that declares named inputs needs none of this: it maps event fields onto that agent’s inputs and sends to it directly. Its Settings › Delivery line reads “Sends to {agent}, mapping event fields onto the inputs it declares”.

Before you start

You need the operator or admin role.
To create the agent from Sift, the Kindo key on the Kindo connection must be allowed to create agents. If it is not, or your Kindo has no create endpoint, use the download path below.

Connect the agent

The page Connect the agent shows the flow the agent runs: this filter sends one event, your steps act on it, and Sift’s last step records whether it was worth acting on. That verdict becomes a training label.

Under Shape, choose how the agent’s steps are laid out:

Choice	Use it for
Steps (recommended)	An agent that acts in stages. Your own steps go after the first, in Kindo, and Sift’s step records the verdict last.
One step	An agent whose acting fits in one step’s tool calls. Cheaper, because each extra step re-reads the whole run (why).

Under What makes an event worth acting on?, write Your criteria.

Sift writes the rest of the prompt. If you leave this empty, the console warns you: the agent answers insufficient_data for every event.
Under What should the agent do about it?, write Your actions (optional): open a ticket, page someone, call an API.

Write them for one event. If the filter groups escalations, a run may carry several events; say “once per group” if that is what you mean. Left empty, the agent only records a verdict until someone adds an action, here or in Kindo.
If you changed either answer, select Apply your answers.

Kindo gets what was last applied.
Under Create it in Kindo, pick the Model.

It starts on Kindo’s default model. Sift can offer only the models it has seen an agent run on in your Kindo (Seen running in this Kindo). Others are listed greyed out under Not available to agents yet. Sift does not store the pick; you can change the model in Kindo afterwards.
Select Create in Kindo and connect.

Sift creates the agent in Kindo with the connection’s key, checks it, and pairs the filter to it.

What you should see

“Created and paired” with the agent’s name and id, then:

Owned by: the user the Kindo key belongs to. The agent starts private to them.
Runs on: the model the agent was seen to run on. “Kindo did not keep the model Sift asked for” means Kindo put it on its default; set it in Kindo, or pick another.
After creating: what is left to do in Kindo, such as adding your own steps and tools.

Select Back to actions; the line beside it names the next step. Once the gold set is approved, that is usually start watching in shadow: select Start in shadow on the Actions tab.

If the filter is already filtering

On an active filter, Sift first shows what pairing would change. Choose:

Create, pair and return to shadow: the filter stops filtering and returns to shadow until a threshold is approved for the new version.
Create, pair and keep filtering, offered when the standing approval may be re-affirmed. Write Why (required to keep filtering): use it for a copy, a move, or a change that does not alter the agent’s verdicts. Sift then watches the new agent’s leak-through verdicts and raises an alarm if it finds filtered events actionable.

Import the agent yourself

Use this when the key may not create agents, when your Kindo has no create endpoint, or when you want the file. The section Other ways to connect it opens by itself when creating is not possible.

Select Download the definition.

What is in the file lists the agent’s name, steps, the inputs it declares, the verdicts it may return, its triggers (none: only Sift starts it), its tools (none yet), the model and the contract version.
Import the file in Kindo.

Import always creates a new agent. Nothing you already have is overwritten.
Do what After importing lists, in Kindo.
Under Paste the new agent’s id back, enter the new agent’s id in Agent id and select Check.

Use the new id, not the one the filter was modelled on. Sift reads the agent back and refuses unless it declares the input the filter fills.
Select Pair. On an active filter the choices are Pair and return to shadow and, where the standing approval may be re-affirmed, Pair and keep filtering, as above.

The page says “Paired with {id}”.

Regenerate or replace the agent

Any change to the agent is a new agent; the old one keeps running until you retire it in Kindo (why).

Open Settings › Delivery. The Agent block shows what the filter is paired with, its contract version, and whether it takes single events or groups. Its buttons:

Button	What it does
Download agent	Downloads the agent Sift would generate now, with the instructions recorded at the last pairing. It is regenerated, not the file you imported.
Change paired agent	Pair with another agent by id, as in step 4 above.
Generate new agent	Runs the same four steps as above. It reads Regenerate the agent when the filter has a Shape delivery stage and the paired agent takes single events.

You must regenerate when:

The block says “The paired agent is out of date. Regenerate the agent.” Its contract is one Sift no longer supports, so it may act twice on an event sent twice.
You want Shape delivery to group escalations and the paired agent takes single events. The Grouping setting reads “Unavailable: the paired agent takes single events.” until a regenerated agent is paired.

The displaced agent

When pairing replaces the agent a filter sent to, the old one becomes the displaced agent. While the filter is active, Sift checks it every hour, and the Actions tab shows one of two items:

Item	Meaning
Retire it in Kindo	The displaced agent has run again. Retire it in Kindo.
Check it in Kindo	Sift cannot confirm it has stopped, or Kindo reports it gone.

Retiring is done in Kindo, not here. If the agent stays in use for other work, or is already gone, select Dismiss…, add an optional note, and select Dismiss. This records that you accept both may run; it is not a claim the agent was retired, and Sift stops checking it. A new pairing asks again.

When the agent returns no verdicts

The Actions tab reopens the agent step if the agent stops returning verdicts Sift can read:

Fill in its agent’s instructions: the agent was imported with Sift’s placeholder and answers that it has no instructions. Replace the placeholder in Kindo, or generate it again with criteria and pair the new one.
Get its agent’s verdicts back: its newest runs returned no verdict. For an agent Sift generated, check in Kindo that “Sift: record the verdict” is still its last step and unedited. For an agent Sift did not write, open the filter’s Overview, find Briefing for the agent under Ingest and delivery, and paste it into the agent’s last step (Paste this into your agent’s prompt).

See the Agent contract for what the agent must return.

What can go wrong

You see	What to do
“Kindo does not allow this key to create agents”	Use Other ways to connect it, or have a Kindo admin allow it.
“This Kindo does not offer agent creation”	Use the download path. Sift remembers this for an hour.
“Sift created {id} in Kindo and could not pair it”	Select Pair to it. Do not create again: every create makes a new agent.
Kindo’s answer was lost	The message names a `sift-create:` marker. Look for it in the description of your agents in Kindo before pressing again.
This agent cannot be paired.	The agent does not declare the input the filter fills. Check the id, or import the definition again.