Public sector
Beam for public sector
Public-sector teams adopting AI coding agents need a record of what those agents did that doesn't depend on trusting a vendor's cloud. Beam runs locally, keeps its record on the machine, and can be self-hosted end to end — including the fleet dashboard.
Beam has no FedRAMP or StateRAMP authorization today. Say so plainly if that's a requirement, rather than implying otherwise.
What matters for an agency environment
Local-first isn't a feature bullet here — it's the reason Beam is workable in environments with real network and data-residency constraints.
- No cloud dependency
Collector binds to loopback only
127.0.0.1:4319 by default. Nothing needs to reach the internet for Beam's core recording to work.
- Self-hostable
Run the dashboard inside your own network
The fleet dashboard is a Next.js app backed by Postgres — deploy it on infrastructure your agency controls, not Beam's.
- Open source
Read what runs before you approve it
Beam CLI's core is public. An agency's security team can review the code that watches its endpoints, not just take a vendor's word for it.
- Evidence
A record that survives an oversight request
Timestamped, exportable events with SHA-256-hashed case bundles — built to be handed to an inspector general or auditor, not just a dashboard.
- Supply chain
Vet MCP servers and skills before they run
Eleven heuristic patterns plus a version-pin check, before a third-party server or skill file gets trusted on an agency machine.
How an agency team evaluates it
- 01
Instrument a small set of machines
A hook merged into settings plus a local service — no outbound dependency required.
- 02
Self-host the dashboard if you need one
Deploy the Next.js + Postgres dashboard inside your own network boundary, or skip it and read local NDJSON directly.
- 03
Produce a record for whoever's asking
A redacted export or a hashed case bundle — built for the kind of request an oversight body actually makes.
Where Beam fits, and where it doesn't
Beam does
- Run entirely without a cloud dependency — collector and, optionally, the dashboard
- Give you an open-source core you can review before you trust it
- Produce a timestamped, exportable, hash-verified activity record
- Scan MCP configs and skills before they're connected
Beam does not
- Hold FedRAMP, StateRAMP or any other government authorization today
- Block or gate an agent's actions in v1 — observe and alert only
- Provide a signed MDM package (Jamf/Kandji/Intune) for fleet rollout yet
- Replace an agency's existing ATO process or security controls
Questions from agency security reviews
Is Beam FedRAMP or StateRAMP authorized?
No. Beam has no such authorization as of this writing. If that's a hard requirement for your procurement, say so — Beam's answer here is honest rather than aspirational.
Can we run the whole stack without touching Beam's cloud?
Yes. The collector binds to loopback by default and never needs outbound access to record. The fleet dashboard is self-hostable — a Next.js app on Postgres you deploy and own.
Can we audit the code that runs on our endpoints?
Beam CLI's core is open source. Read it before you trust it, rather than taking a vendor's description on faith.
Does Beam enforce policy today?
Yes, when workspace policy is set to enforce, for matching Claude Code and Codex tool calls. Sentinel can pause or block high-risk browser AI sends. Cursor, Copilot CLI and Gemini currently get a deny note, not a verified block. Missing or expired cached policy allows the action.
Related
See what's actually running before you write policy about it
Instrument a handful of machines, entirely inside your own network, and get a real record to work from.