The AI can read. Only a person can write.
This page is the actual model, not a summary of it. Every claim below corresponds to a check in the code, and the ones that matter most are invariants the hub enforces on every request.
The tool map is the boundary
The agent exposes a fixed set of named tools with typed, validated inputs. Arguments go to the operating system as arguments, never pasted into a shell string. There is no generic execute path.
Shell is local policy
Whether run_shell exists on a machine is a flag in that machine's own config file. The hub cannot set it. If it is off, BE AI can propose a command and the machine will refuse it.
Only signed binaries
Agents update only from a manifest signed by an offline Ed25519 key. The hub can choose which signed version a machine gets; it cannot supply code. A compromised hub cannot push a rogue agent.
Tiering lives in the hub
Read-only tools run automatically. Every mutating tool is behind a proposal and a named approval. New mutating tools default to approval. Every call goes through one audited path.
Company scope on every request
Machines belong to the company that enrolled them. Another company's token cannot claim a machine. Every handler filters by company; anything out of scope is a 404, not a 403, so ids do not leak.
Machine output is untrusted
Logs, process names and file paths flow into the model as text. Containment is the tool allow-list and tiering, not sanitising strings. The model reports when a tool result tried to instruct it.
- ✓outbound HTTPS only, no listening port
- ✓optional certificate pinning to the hub
- ✓command output capped at 256 KB, timeouts on everything
- ✓checks are data validated on the machine, never code
- ✓Go static binary, no runtime, no package dependencies
- ✓passwords hashed with scrypt, sessions in HttpOnly cookies
- ✓lockout after five failed sign-ins per address and user
- ✓three roles: superadmin, company admin, operator
- ✓tokens and keys rotate; a rotated token locks the old one out
- ✓append-only audit trail of calls, results, approvals, sign-ins
Honest list of what is not a hard guarantee.
The model's judgement
BE AI can be wrong. That is why it cannot act. Read the reason on a proposal the way you would read a junior's change request.
Your approvers
An approval is as good as the person clicking it. Company admins decide who gets an account; the audit trail says who approved what.
Whoever runs the hub
Hosted by Binary Elements, you trust our operations: backups, patching, access. [Link to hosting terms.] On your own premises or in your own cloud, the hub is one container and one volume, and those are yours to run.
What is stored, for how long.
| data | kept | notes |
|---|---|---|
| heartbeats | 14 days | raw, every five minutes |
| hourly rollups | 2 years | per machine and per company |
| events, alerts, check results | 1 year | |
| BE AI runs and transcripts | kept | tool calls and results, capped |
| audit trail | kept | append-only |
| command output | with the proposal | capped at 256 KB |
Retention is configurable per hub. [Confirm defaults and the hosted region before publishing.]
Put BE Hub on ten machines this week.
A pilot takes an afternoon: one install link, your own approvals, your own data. Uninstall the agent and you are out.