Session review

Rules catch the calls you can describe in advance. A hijacked agent often makes calls that each look ordinary; what gives it away is the gap between what the user asked for and what the agent went on to do. Golem's investigator reads finished conversations for that gap and raises a flag for a person when it finds one. It never blocks a call. Blocking is the job of rules, which run on the machine with no model involved.

The investigator is off until a workspace admin turns it on, because it costs money and it reads your conversations.

Turn it on#

1. In the console, open Defender (under Detect & Enforce).
2. Switch on the Investigator tile and confirm. The confirmation tells you that it calls a model once per conversation and that this costs money.
3. Choose Settings on the same tile to pick the model, set the monthly cap and decide what it may read.
4. Under Hosts, Groups & Profiles, each profile's Investigator section says whether conversations from its machines are read (Read) or not (Skip).

Everything below is set from that Settings sheet unless it says otherwise. Only workspace admins can change it.

The readers#

The investigator is several readers, each named for what it is allowed to see. A reader that could not see something says so, and that admission is what sends the question to a reader that can.

The metadata and argument analyst never sees payload bodies. Each argument it reads is cut to 400 characters, after the same redaction applied when the call was recorded.

Which conversations are read#

A conversation is read once it has been quiet for the Settle window (30 minutes by default) and it has at least one tool call and a prompt from a person or another agent. For Claude Code, prompts reach Golem only through its OpenTelemetry export, so turn that on (see Claude Code) or its sessions will rarely qualify. The investigator runs every five minutes and reads at most Conversations per pass each time (20 by default, up to 500), unread conversations first. A conversation it has already assessed is not read again unless it changed.

You can narrow it further:

• Only these agents and Never these agents limit it by agent. An exclusion wins over an inclusion.
• The profile's Read or Skip limits it by machine.
• Golem's own agents are never read, so the investigator does not spend money reading itself.

What it produces#

Every assessment is recorded. Only a conversation judged misaligned with a confidence at or above the Flag threshold (0.70 by default) becomes a flag, at severity suspicious, in the same queue as rule flags. The flag's notes carry the reader's reasoning and the evidence it cited. What happens next is up to a person: see Cases and evidence export.

The second reader#

Before a case file reaches a person, the Supervisor reads it back. It sees only the rendered case file, not the conversation. It can:

• accept it, when nothing stands as a suspicion;
• ask one question of the metadata analyst or the payload analyst, and read the file again with the answer;
• hand it to a person, which raises a flag if there is not already an open one.

After three rounds of questions the file goes to a person without another model call. When a file is handed over and your workspace has a default case assignee, Golem also opens a case for it.

Your model, your key, your ceiling#

Choose the model under Model in the settings sheet:

You can name a different model for the payload analyst and for the supervisor. A key is pasted once, sealed under your workspace's own key, and shown afterward only as a fingerprint. Changing the provider needs a new key. If your chosen provider fails or refuses, Golem does not fall back to another one.

The Monthly spend cap is in US dollars per calendar month (UTC). A workspace that never set one gets $100. At the cap the investigator stops handing out work and resumes when the month turns; it can overshoot by at most one pass. If a call this month had no configured price, the cap cannot be counted, so the investigator stops rather than guess. Clearing the field removes the ceiling entirely, and the console says so.

Every reader is on the record#

Each reader joins your workspace as its own principal and signs what it does into the same signed record as your agents' work. For each conversation it assesses, the metadata analyst signs that it read the conversation, that it called the model, its verdict, and any flag it raised. The text it read is not copied into those entries.

They appear under Hosts, Groups & Profiles in a read-only Golem group. To stop one, turn its feature off or revoke its host. On the Conversations page, Hide Golem agents keeps their own sessions out of your way.

Measuring it#

A reader's verdict is only worth what people think of it once they read it. On the Defender page, Check one shows you a case file drawn at random from the last seven days, half from conversations the investigator passed and half from ones it did not. You mark Agree or Disagree with an optional line, or Skip. The page shows how often people agreed over the last 30 days, split by verdict.

Threat intelligence#

Threat intelligence is a separate switch on the Defender page, off by default. When the investigator marks a step suspicious, Golem looks up the hosts, URLs and hashes on that step with outside reputation sources, and files what comes back as findings. Each lookup is signed as golem-threat-intelligence. It never reads a conversation.

Turn it on knowingly: a lookup can cost money at the source, and it tells that source an indicator from your traffic. The sources are Google Safe Browsing, PhishTank and URLhaus, which need your keys, and domain registration (RDAP) and DNS blocklist checks, which do not. PhishTank and URLhaus are checked against a local copy of their published lists. Results are cached for between four hours and 30 days, depending on the source. At most four steps per case file are looked up.

Golem's reviewer agent#

A rule at Ask can hand the held call to a model instead of a person. Turn this on under Protections → Settings, in the Asks for review card, with Golem's reviewer agent.

The reviewer sees the tool, the rule that held the call, the rule's own instructions, and the redacted arguments (up to 8 KiB). It can refuse the call or hand it to a person. It lets a call through only where the rule allows that (Also let through). Calls it hands over wait in the Review Queue under Held calls. It shares the investigator's monthly cap: once the budget is spent, every held call goes to a person. See Block, hold and contain.

Run the readers yourself#

Run the readers yourself, in The readers section, gives you a container to run on your own infrastructure. The readers then call your model from your network and still sign into your workspace's record as the principals above.

What it does not do#

• It does not decide what gets blocked. Allow, refuse and hold are made on the machine from your rules, with no model.
• It does not act. It raises flags. Turning a finding into an enforced rule is a separate, measured step that is off by default; see From a finding to a rule.
• It does not read every conversation by default. It reads only once you turn it on, only from machines whose profile says Read, and only within the cap.