From a full disk at 07:12 to a fix approved at 07:19.
The whole loop on one real-shaped incident: what the agent sends, what BE AI is allowed to do, what a person decides, and what ends up on the record.
The agent raises disk_high
D: on srv-books crosses 90%. The agent sends one event with the volume and the number. It has been sending a heartbeat every five minutes for months, so the hub already has the trend.
The hub opens an alert and starts BE AI
Alert "srv-books · disk D: 96%" opens as a warning. The disk_high recipe starts: history first, then the machine.
BE AI reads, then asks
get_samples over 7 days shows +0.9% a day. get_diagnostics, list_processes, the event log and a bounded directory listing, eight read-only calls in all, show D:\Backups at 231 GB of a 500 GB volume. Every call is on the record.
It concludes and proposes nothing yet
"Degraded, high confidence. Backups are the cause; nothing else unusual. Review files older than 30 days before deleting." The alert notification goes out a minute later with this attached.
Sam replies from the phone
"List what's older than 30 days first, then clean it up." BE AI files a read-only listing as a proposal. Sam approves it; it runs; 38 files, 212 GB.
The delete is proposed, then approved
One proposal, the exact command, the reason "same 38 files you reviewed, your notes say keep 30 days". Sam approves. It runs in 2 seconds. Result: completed without errors.
Verified and closed
"Verify the effect": BE AI reads the disk again: 54% used on a 500 GB volume. The next heartbeat resolves the alert on its own. The thread, both approvals and the output sit in the audit trail under Sam's name.
What BE AI can and cannot do, in code, not in a policy document.
A fixed set of tools
Diagnostics, metrics, processes, services, logs, checks, network facts, and the hub's own history. Nothing else exists for it to call.
Budgets
At most 15 tool calls and 12 turns per run, three minutes, a cap on runs per company per day. It has to conclude.
Untrusted input
Log lines, process names and file paths are data. A hostile string in a log cannot make the model do anything the tools do not allow.
Proposals need a person
Every mutating tool is behind an approval on the hub. The model cannot approve its own proposal, and neither can a scheduled job.
Shell is local policy
Whether a machine allows shell commands at all is decided in its own config file. The hub cannot switch it on.
Everything is recorded
Runs keep their transcript. Proposals keep their output. Approvals keep the name. Sign-ins and failures too.
Put BE Hub on ten machines this week.
A pilot takes an afternoon: one install link, your own approvals, your own data. Uninstall the agent and you are out.