Beam turns the AI activity you instrument into one timestamped, redacted, exportable record — so a Claude Code session and a Cursor session read the same way. It is audit evidence, not a certification.
Beam does not attest to a control, satisfy a framework on your behalf, or guarantee compliance with anything.
Vendor and IDE controls stop at their own tool, and people move between AI tools all day. Every source normalizes into the same fields, which is what makes a mixed record reviewable.
Identity
event_id, timestamp, source_agent and session_id, so an action traces back to a specific run rather than a machine.
Action
event_type and tool_name alongside the command, file_path or url the event concerned.
Context
project_path and endpoint.hostname place the action in a repository and, where instrumented, against a destination host.
Cost
Per-event model, input_tokens, output_tokens and cost_usd. Missing values stay unknown; Beam infers no pricing.
Review
Flagged actions can be marked reviewed, and that review persists — the difference between a log and an audit trail.
Export
A redacted NDJSON export, or a case bundling event, scan and review files with SHA-256 hashes.
August 2026
Gartner puts the market for securing AI at almost $4.8 billion in 2027 — up 68.7% over 2026 — and almost $7.7 billion by 2028.
By 2028 (Gartner prediction)
The post-incident question becomes what the AI did and when — answerable only if something was recording at the time.
2025–2026
Deloitte found roughly 21% of agentic-AI adopters have mature governance, and one in five organizations report an AI-agent security incident.
01
Hook payloads, OTLP/HTTP JSON logs and imported numbat records normalize into one schema, preserving source references and ATT&CK tags.
02
Credential formats, auth headers, URL query values and private keys are stripped before anything reaches disk.
03
Download a redacted log or a case container with SHA-256 hashes. Inspect it before sharing — other sensitive text may survive redaction.
No. Beam produces audit evidence about the AI activity you instrument — a normalized, redacted, exportable record you can bring to a review. It is not a certification, an attestation or a compliance guarantee, and no framework is satisfied by installing it.
Because those controls stop at their own tool. Someone working in Cursor in the morning and Claude Code in the afternoon produces two partial records in two shapes, and neither covers the other. Beam normalizes both so a reviewer reads one trail.
That the files inside the exported case are internally consistent with the manifest. They do not establish authenticity, chain of custody or completeness, and the export uses Beam's own schema rather than a raw replay of an upstream tool's records.
Not automatically. Beam ingests OTLP/HTTP JSON and exports redacted NDJSON, so the data is portable, but there is no built-in forwarder and no background export. Anything that leaves the machine leaves because you moved it.
One schema, one timeline, one export — across whichever AI tools your teams are using this week.