Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

Beyond Keywords: Engineering a Production-Ready Agentic Search Framework in Go

Search systems have historically been optimized for retrieval: given a query, return the most relevant documents. That model breaks down the moment user intent shifts from finding information to solving problems. Consider a query…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

Search systems have historically been optimized for retrieval: given a query, return the most relevant documents. That model breaks down the moment user intent shifts from finding information to solving problems.



Consider a query like:




“How will tomorrow's weather in Seattle affect flight prices to JFK?”




This isn't a search problem. It's a reasoning problem — one that requires decomposition, orchestration across multiple systems, and synthesis into a coherent answer.



This is where agentic search comes in.



In this article, I'll walk through how we designed and productionized an agentic search framework in Go — not as a demo, but as a real system operating under production constraints like latency, cost, concurrency, and failure modes.





Keyword and vector search systems excel at matching queries to documents. What they don't handle well is:




  • Multi-step reasoning

  • Tool coordination

  • Query decomposition

  • Answer synthesis



Agentic search treats the LLM not as a text generator, but as a planner — a component that decides what actions to take to answer a question.



At a high level, an agentic system must be able to:




  1. Understand user intent

  2. Decide which tools to call

  3. Execute those tools safely

  4. Iterate when necessary

  5. Synthesize a final response



The hard part isn't wiring an LLM to tools. The hard part is doing this predictably and economically in production.






High-Level Architecture



We structured the system around three core concerns:





  1. Planning – deciding what to do


  2. Execution – running tools efficiently


  3. Synthesis – producing the final answer



Here’s the end-to-end flow:



Each stage is deliberately isolated. Reasoning does not leak into execution, and execution does not influence planning decisions directly.






Flow Orchestrator: The Control Plane



The Flow Orchestrator manages the full lifecycle of a request. Its responsibilities include:




  • Coordinating planner invocations

  • Executing tools concurrently

  • Handling retries, timeouts, and cancellations

  • Streaming partial responses



Instead of a linear pipeline, the orchestrator supports parallel execution using Go's goroutines. This becomes essential once multiple independent tools are involved.






Query Planner: Mandatory First Pass, Conditional Iteration



The Query Planner is always invoked at least once.






First Planner Call (Always)



On the first invocation, the planner:




  • Analyzes the user query

  • Produces an initial set of tool calls

  • Establishes a consistent reasoning baseline



Even trivial queries go through this step to maintain uniform behavior and observability.






Lightweight Classifier Gate



Before invoking the planner a second time, we run a lightweight classifier model to determine whether the query is:




  • Single-step

  • Multi-step



This classifier is intentionally cheap and fast.






Second Planner Call (Only for Multi-Step Queries)



If the query is classified as multi-step:




  • The planner is invoked again

  • It receives:

  • The original user query

  • Tool responses from the first execution


  • It determines:


  • Whether more tools are required


  • Which tools to call next


  • How to sequence them




This prevents uncontrolled planner loops — one of the most common failure modes in agentic systems.






Tool Registry: Where Reasoning Meets Reality



Every tool implements a strict Go interface:




// ToolInterface is the tool interface for developers to implement which uses
// generics with strongly typed
type ToolInterface[Input any, Output any] interface {
// Execute initiates the execution of a tool.
//
// Parameters:
// - input: Strong typed tool request input.
// - output: Strong typed tool request output.
// - toolContext: Additional output data that is not used by the agent model.
// - err: structured error from tool. in some cases error is passed to LLM. eg: no_response from tool
Execute(ctx context.Context, requestContext *RequestContext, input Input) (output Output, toolContext ToolResponseContext, err error)

// GetDefinition gets the tool definition sent to Large Language Model.
GetDefinition() ToolDefinition
}







This design gives us:




  • Natural-language outputs for planner feedback

  • Structured metadata for downstream use

  • Compile-time safety

  • Safe parallel execution



The Tool Registry acts as a trust boundary. Planner outputs are treated as intent — not instructions.






Parallel Tool Execution



Planner-generated tool calls are executed concurrently whenever possible.



Go's concurrency model makes this practical:




  • Lightweight goroutines

  • Context-based cancellation

  • Efficient I/O-bound execution



This is one of the reasons Go scales better than Python when agentic systems move beyond prototypes.






Response Generation and Streaming



Once tools complete, responses flow into the Response Generator.





  • Knowledge-based queries are summarized and synthesized using an LLM.


  • Direct-answer queries (weather, sports, stocks) bypass synthesis and return raw tool output.



Responses are streamed via Server-Sent Events (SSE) so users see partial results early, improving perceived latency.






Caching Strategy: Making Agentic Search Economical



One production reality became clear almost immediately: LLM calls have real cost — in both latency and dollars.



Once we began serving beta traffic, caching became mandatory. Our guiding principle was simple: Avoid LLM calls whenever possible.






Layer 1: Semantic Cache (Full Response)



We first check a semantic cache keyed on the user query.




  • Cache hit → return response immediately

  • Entire agentic flow is bypassed
    This delivers the biggest latency and cost win.






Layer 2: Planner Response Cache



If the semantic cache misses, we check whether the planner output (tool plan) is cached.




  • Skips the planner LLM call

  • Executes tools directly
    Planner calls are among the most expensive and variable operations — caching them stabilizes both latency and cost.






Layer 3: Summarizer Cache



Finally, we cache summarizer outputs.




  • Tool results often repeat

  • Final synthesis can be reused

  • Reduces LLM load during traffic spikes



Each cache layer short-circuits a different part of the pipeline.






Lessons from Production



A few hard-earned lessons:





  1. LLM calls are expensive — caching isn't optional at scale


  2. Semantic caching pays off immediately


  3. Planner loops must be gated


  4. Most queries are simpler than they look


  5. Tools fail — retries and fallbacks matter


  6. Observability is non-negotiable


  7. Agents aren't autonomous — orchestration beats autonomy

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense
Syntax validiert (0 Fehler)
title: Detect Exploitation - Beyond Keywords: Engineering a Production-Ready Agentic Search Framework in Go
id: ce0027f5-3b5f-4cf7-9237-177dd005119e
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-26
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-26"
        description = "YARA Signature for "
    strings:
        $str = "Beyond Keywords: Engineering a" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Beyond Keywords Engineering a Production")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*Beyond Keywords Engineering a Production*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "Beyond Keywords Engineering a Production"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Beyond Keywords: Engineering a Productio.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Beyond Keywords: Engineering a Production-Ready Agentic Search Framework in Go

Thematisch verwandte Begriffe: Beyond, Keywords, Engineering, ProductionReady · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-88003 | InvoicePlane is a self-hosted open source application for managing invoi…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag