# Limits, and what Golem does not do

> Where each protection works, where it is only as strong as the client's hook, and what Golem deliberately leaves alone.

This page collects the edges in one place, so you meet them here rather than in a pilot. Each item links to the page that covers it in full.

## Where each layer works

| Layer | Works in | Platforms |
|---|---|---|
| Answers the hook: block, hold, a reason on refusal | Claude Code, Cursor, Codex, GitHub Copilot, Antigravity, Devin, Gemini CLI; Hermes and OpenClaw by plugin | macOS, Linux, Windows |
| The MCP path | Any MCP client | macOS, Linux, Windows |
| Kernel jail on every shell command | Claude Code | macOS |
| VM sandbox for untrusted work | Any agent that can call Golem's MCP tools | Apple silicon, macOS 26 or later |
| Signed record | Everything above | All of them |

- The shell jail is not available on Linux or Windows yet, and does not wrap other agents' shells. See [The shell jail](/shield#the-shell-jail).
- The sandbox needs Apple silicon, macOS 26 or later and Claude Code installed. Elsewhere its tools report that it is unavailable. See [The sandbox](/shield#the-sandbox).
- Hardware-backed signing keys need a Mac with a Secure Enclave or a Linux machine with a TPM 2.0. See [Hardware-backed keys](/record#hardware-backed-keys).

## A hook is only as strong as the client

A hook is cooperative. The agent's runtime calls it before a tool runs and honours its answer. That stops a model that misbehaves. It does not stop:

- a runtime that skips its hooks, or a user who removes them;
- what a shell command starts once it is running. A command allowed to run can start other programs without asking again. On a Mac, the [shell jail](/shield#the-shell-jail) limits what those can reach for Claude Code; elsewhere nothing does;
- tools the client never routes through a hook.

The MCP path does not depend on the agent choosing to ask: Golem is the server the client calls, so a refused call never reaches the real one. For tools that only have a hook, Golem's control is as strong as that hook. Golem notices when an agent reports tools running with no hook having reached it, marks the machine **inline enforcement quiet** on its page in the console, and raises an alert. `golem doctor` on the machine names the fix.

## Where a hold becomes a refusal

A rule at Ask holds a call for a decision, but not every client can wait. Where it cannot, the call is refused, never quietly allowed. See [Block, hold and contain](/response).

| Where | What an Ask does |
|---|---|
| Claude Code | Its own approval prompt, in every permission mode. |
| Cursor | Its own prompt in the Allowlist run mode. In Auto-review and Run Everything, Cursor would run the call past a prompt, so Golem refuses it. |
| Codex | Refused: Codex's hooks cannot ask. |
| Any hook, Ask decided by your team | Refused with a message saying who decides and how to get it approved; a hook cannot wait for a person in the console. |
| Any hook, Ask decided by Golem's reviewer agent | Held for up to 35 seconds; if undecided, refused, and a retry waits on the same held call. |
| The MCP path | Held for the workspace's **Default wait for an answer** (30 seconds unless you change it; a rule can set its own); then **If no one answers** applies, **Block it** by default. |

## When Golem is down or slow

Golem is built so that an outage does not stop your engineers, and so that the protections that do not need it keep working. These are the defaults:

| If | Then |
|---|---|
| The Golem agent does not answer a hook | The client lets the call through. Golem registers its hooks with a 45-second timeout. |
| An MCP server behind Golem is down | The call fails with an error: there is no server to pass it to. The profile's **Policy failure mode** (Fail open by default) changes only the error the agent gets. |
| The Golem agent itself is stopped | MCP servers wired through it cannot be reached until it is back. Hooks let calls through, as above. |
| Nobody answers a held MCP call | **Block it**, unless you chose **Let it through**. |
| The shell jail cannot reach the Golem agent within 250 ms | It applies the last known policy, or a baseline: credential stores and persistence writes stay denied, the network stays open. |
| The model relay is unreachable | Redaction applies only the on-machine patterns; names and addresses are not removed from that payload. |
| The machine is offline | Entries are signed and kept on the machine, and sent when it reconnects. |

## What is not captured or checked

- **Commands you type yourself.** Golem watches agents, not your terminal.
- **AI tools Golem is not wired into.** They still turn up, named, with the machine they ran on, but their calls are not checked. See [Shadow AI](/coverage#shadow-ai).
- **Claude Code's file tools and the jail.** Read, Write and Edit do not go through a shell, so the jail does not see them; rules still do.
- **Results that do not pass through Golem.** A rule on a tool's result, and redaction of what the agent reads, act only where the result passes through Golem: Claude Code's hooks and Golem's MCP gateway. Other agents' hooks get the block and the reason only.
- **Model traffic.** Prompts and responses passing through Golem's provider proxies reach the provider unredacted; only Golem's stored copy is redacted. See [Redaction](/redaction#what-is-not-redacted).
- **The browser.** The extension covers ChatGPT, Claude.ai and Gemini in the browser it is installed in. See [Browser extension](/agents/browser-extension).

## Size limits you could hit

| What | Limit | Past it |
|---|---|---|
| A tool call's hook payload | 5 MB | Not checked: the client treats the refusal to read it as an error and lets the call through. |
| An MCP request through Golem | 5 MB | Refused as too large. |
| One response line from a local (stdio) MCP server | 1 MB | Dropped, and the agent gets an error. |
| A field Golem redacts | 1 MiB | Not scanned; stored as written and kept out of search. |
| Text sent to the model relay for names and addresses | 100 KB | Only the on-machine patterns apply. |
| A result scored by the prompt-injection check | first 32 KB | The rest is not scored. |
| Testing a rule on past traffic | 30 days, newest 20,000 entries | Older entries are not tested. |
| Files handed to `sandbox_open` | 20 files, 100 MB each, 500 MB in all | Refused. |

## Models never make the block decision

A block is a local rule check: compiled CEL, with no model and no network hop. Models appear in three places, none of which is that decision:

- **The prompt-injection check** scores what an agent read. A rule on that score decides. It is off until you turn it on.
- **Golem's reviewer agent** decides only the held calls a rule hands to it. It refuses them or hands them to a person, and lets one through only where that rule says it may. It is off until an owner or admin turns it on.
- **Golem's investigators** read sessions after the fact and raise flags for a person. They do not act on their own, and a rule they propose waits for a person by default. See [From a finding to a rule](/rules#from-a-finding-to-a-rule).

Reading payload bodies is off by default too: the investigators read metadata and redacted, shortened arguments unless you turn payload reading on. See [Session review](/review).

## What Golem deliberately does not do

- **No irreversible containment.** Quarantine, Restrict to Safe and a locked-down session are all reversible by a person. Golem's containment never deletes files, kills an agent's processes or wipes a machine, because no detector is accurate enough to justify an action you cannot take back. See [Quarantine a machine](/response#quarantine-a-machine).
- **No loosening from inside a session.** `/safely` and a lockdown only tighten. An agent cannot talk its way back out, and neither can content it read. See [Safely](/response#safely).
- **No rewriting the record.** Not by you, not by an agent, not by Golem. A correction is a new entry. See [The signed record](/record).
- **No credential values in alerts.** The config scan reports a plaintext secret by the variable's name, never its value.
- **No catching an injection by isolation alone.** The sandbox limits what an injection can reach; it does not detect one. The prompt-injection check is a separate, opt-in signal, and like any detector it misses some.