Beam: Guiding agents as they work, with tiered escalation
How do I reduce agent risk without stopping the work?
The common way to control an AI agent is either allowing or blocking the action when the agent tries something risky. Blocking is the right measure for installing a malicious package. For much of what agents do day to day though, a block stops the action without telling the agent anything it can learn from. As a result, an agent built to finish its task may look for a workaround.
One of our customers saw this happen: a coding agent was helping a developer with legitimate work when its sandbox blocked a network request the task needed. The agent didn’t ask the developer what to do; it switched the sandbox off for that command and carried on. The security team spotted the change in Geordie and created a Beam policy to catch it.
The sandbox did its job in this scenario and the agent still ended up taking an action against the team’s will. They needed a way to tell the agent why the request was refused and what to do instead, with a hard stop kept for the few rules that must never be broken. Beam was built for situations exactly like this one.
What: Beam responds across a range, from monitoring to guiding to enforcing
Beam is Geordie’s remediation engine, built to guide agents in context. It evaluates the actions agents take against the policies a team sets and each policy runs in one of four modes:
- Monitor: Records what a policy matches, with no intervention
- Guide: Guidance in the agent’s context while the work continues
- Confirm: Pauses the agent until its operator decides
- Enforce: Always-on policy where a rule must hold
Teams move each policy along that range as their confidence in it grows. Not every policy needs to reach Enforce. In Geordie’s terms, Enforce controls what must always hold, and Guide shapes what can be improved.
How: Guidance reaches the agent through its own context
An agent decides what to do next from what is in its context, which includes the task, its instructions, the results of earlier tool calls and anything its harness adds. When an agent does something a security team wouldn’t want, the cause usually sits there, because nothing in its context told it that the account it was signed in with was personal, that an MCP server wasn’t approved or that a key it had been handed belonged in a vault.
When a Guide policy matches, Beam adds a message written by the team that owns the policy to the agent’s context before the tool call runs, and the agent reads it as it would any other instruction. In the customer sessions we have observed, agents acknowledge the guidance, change their next step and tell the user why.
Guide works the way security awareness training would if every lesson reached people at the moment they were about to make the mistake it warns about.
Each piece of guidance is shaped by the context Geordie holds about the agent receiving it. Geordie already understands each agent’s configuration, its tools and connections, the account it uses, the risks detected on it and what it costs to run, so a policy can apply where a risk exists and leave a similar agent alone. A finance agent authorized to handle financial data keeps doing so, while an agent without that authorization receives guidance when it reaches for the same data.
For the rules that must always hold, Beam uses the same route to block the call and return the reason, so the agent and the user still learn why. Today these responses travel through the lifecycle hooks in Claude Code, Cursor and Codex,123 and the route will change as the harnesses do.
Why: Beam differs from allow-or-block controls
Deciding whether a tool call can run is now something many agent platforms do themselves. Claude Code, Cursor and Codex each let an organization deny a tool call before it runs,123 Anthropic has made inline policy enforcement available in beta across Claude Enterprise,6 and Copilot Studio accepts an allow-or-block decision from external providers.5
Gateways, endpoint tools and browser controls make the same decision at their own boundaries. That decision is necessary and Beam makes it too, yet on its own it leaves a team with two answers to every risk. Geordie runs alongside the gateways and platform controls customers already have.
Beam differs in three ways:
- It responds across a range. A verdict gives a team two answers to a risk and Beam gives four, so most risks can be corrected without stopping the agent and blocking is kept for the cases that need it.
- It knows the agent it is responding to. Each response draws on what Geordie already knows about that agent, so the same policy can treat two similar agents differently. A boundary control sees the request or the traffic in front of it. The knowledge is built continuously and out of band from each agent’s history, so the response at the moment of the tool call draws on analysis that has already happened.
- It applies one set of policies across platforms. The same policies cover Claude Code, Cursor and Codex, and Copilot Studio for monitoring and enforcement, while each platform’s native controls cover only its own agents and are configured separately.
Evaluation: Questions to ask about any agent control
Whichever controls a team runs today, these questions show quickly whether they can do more than allow or block:
- When the control refuses a tool call, what does the agent do next, and what does the user see?
- Of the risky steps in your agents’ recent activity, how many could have been corrected with guidance instead of stopped?
- What does a policy know about the agent it applies to, beyond the request in front of it?
- How do you test a policy against real activity before it can block anyone?
- On which of your agent platforms can the control give guidance, and on which can it only allow or block?
Teams that want to see Beam on their own agents can get in touch through geordie.ai.
References
- Anthropic, Hooks reference, Claude Code documentation
- Cursor, Hooks, Cursor documentation
- OpenAI, Hooks, Codex documentation
- Anthropic, Effective context engineering for AI agents, September 29, 2025
- Microsoft, Enable external threat detection and protection for Copilot Studio custom agents
- Anthropic, Inference hooks: inline data loss prevention for Claude Enterprise, August 5, 2026
