Slack built a multi-agent security investigation service that runs over hundreds of inference calls and megabytes of output per investigation, and designed a context management system that keeps the team of agents working coherently across rounds. The system uses three complementary context channels — Director's Journal, Critic's Review, and Critic's Timeline — each shaped to what one role in the team needs to see.
The Director orchestrates each investigation: deciding which questions to ask, which Expert agents to engage, and when to conclude. To make coherent decisions across rounds, the Director has a journaling tool that captures six entry types — decision, observation, finding, question, action, hypothesis — in structured entries with priority and citation references to evidential artifacts. Every agent receives the current content of the Journal in their prompt, presented as chronology. The Journal lets the Director lead the investigation toward a conclusion, observe progress, identify dead ends, and make course corrections.
The Critic role reviews Expert findings and assigns credibility scores. The Critic's Review is an annotated findings report; the Critic's Timeline is a consolidated chronological view of all findings with their credibility scores. Each agent in the system receives a tailored view: too little context and the investigation becomes disconnected, too much and creativity is stifled and confirmation bias creeps in. The three channels together give each agent what it needs without overwhelming it.
A worked investigation illustrates the system in action. A kernel-module alert was triggered by a developer installing a package in a development environment; the matching rule was overly sensitive. The Director's Journal tracked the path from initial hypothesis to final ruling. By 09:34, the Director had identified the alert as a likely false positive because the rule matched a script path containing "kmod" rather than actual modprobe execution. By 09:40, all four Experts agreed: FALSE POSITIVE, with a Timeline confidence of 0.83, based on 6,046 events from endpoint queries. The investigation concluded at 09:41.
Authored by Dominic Marks, Staff Software Engineer at Slack, the article was published on the Slack Engineering blog on 13 April 2026. It is the second article in Slack's series on its security investigation service, following an introduction to the Director–Experts–Critic structure. The architecture is one answer to the recurring challenge of how to keep multi-agent systems coherent over long-running tasks where context windows would otherwise force lossy compression.