Turning it on
Warden seat is off by default and follows your account (Mac: Privacy & Security → Local oversight; web and iPhone: Settings → Who's In The Room). A team can require it. A cheap model reads what you asked and each action the lead, or a seat you addressed by name, is about to take, and answers one question: is this still the job? A no stops the run with one sentence. If it cannot answer in time, the run carries on. Reads are not asked about; reviewers only read and are not watched.
Seats on Your CLI
Seats on Your CLI are covered too. Claude Code and Gemini CLI are checked before each action runs. Codex is checked before each action in a folder whose instructions you allowed, otherwise right after it starts. Grok Build has no per-run hook, so it is checked right after each action starts and the seat is stopped.
Which model it asks
Warden model, under the switch, picks the model the warden asks on, the same on the Mac and on server runs. Automatic uses Claude Haiku 4.5 through Our Keys, whatever your seats run, so a room of Opus seats does not pay Opus rates for a yes-or-no check. Each check is charged to your account's credit, a fraction of a cent (about a tenth of a cent on Haiku). A seat on your own key or endpoint is asked instead when its model costs no more. If Our Keys cannot be reached, a seat on your own key, endpoint, cloud or Free Key is asked. You can also pick GPT-6 Luna or Gemini 3.6 Flash, or Same as a seat for the older rule: your cheapest seat. With no credit, or no way to ask, the run tells you once and carries on without checks. Teams have no setting for this model.
What it tells you
The Summary says what it did: "Warden: checked 4 actions, stopped 0", with what the checks cost, or the stop and why. A side-by-side discussion says it was not needed. Test the warden, beside the switch, sends two sample actions (never run) and shows both verdicts.