Summary
- Teleport Beams became generally available on 9 November following a public beta that began in March.
- The product combines delegated identities, restricted cloud and infrastructure access, isolated micro-VMs and traceable agent activity.
- Execution plans, review controls and a kill switch aim to limit the impact of errors or compromised agents.
Teleport has made its Beams runtime generally available, introducing an infrastructure execution environment designed to give AI agents temporary identities, restricted permissions and auditable control over their actions in production systems.
The service became generally available on 9 November 2026, following a public beta that began in March. It is intended for organisations allowing AI agents to interact with infrastructure such as cloud accounts, Kubernetes clusters, databases and connected development tools.
Teleport positions Beams as a way to separate an agent’s ability to propose work from its authority to execute that work. Instead of providing an agent with persistent credentials and broad administrative access, the runtime connects requested operations to delegated identity and approval policies.
Its security model combines controls over identity, infrastructure access, agent behaviour and execution environments. These operate at different points in an agent’s workflow, from the creation of a session to the termination of its authority.
The approach does not guarantee that an AI model will select the correct action. It is designed to restrict the systems that an agent can reach, establish records of its activity and constrain the effects of actions that depart from an approved objective.
Delegated identities replace standing privileges
Each Beams runtime receives an identity delegated by a person or another agent. The company says new agents begin without standing infrastructure privileges and must request authority to perform specific operations.
An agent can propose an execution plan that is reviewed by a human or by a separate AI-based evaluation component. Once the plan has been approved, execution takes place within a runtime granted only the roles associated with that approval.
The arrangement is intended to reduce the need to provide long-lived secrets directly to an AI agent’s operating environment.
Beams supports connections to systems including cloud accounts, PostgreSQL databases, Kubernetes clusters and MCP servers. Depending on the underlying service, authentication can use mechanisms such as IAM, Kerberos or X.509 certificates rather than passwords stored in agent sessions.
Removing a static credential from an agent’s immediate environment reduces one potential avenue for credential disclosure. It does not eliminate security dependencies involving the infrastructure identity provider, the approval process or the authority granted to the runtime.
An approved role that is too broad can still permit damaging activity, while inaccurate execution-plan review may authorise operations that exceed the intended task.
Runtime isolation and behavioural monitoring
Teleport runs agent tasks inside temporary micro-virtual machines with controlled networking. The environment provides restrictions on inbound and outbound connections, including DNS activity, and captures protocol traffic for audit purposes.
The company says runtime images are rebuilt regularly to reduce exposure to known vulnerabilities. Because execution environments are temporary, they can be discarded when the associated task ends rather than remaining available for indefinite reuse.
Beams also records interactions with AI models and connected services, providing a record of the instructions, tool calls and other activity associated with an execution session.
Behavioural monitoring is intended to identify unexpected actions, including attempts to obtain secrets, execute destructive operations or increase privileges. Teleport describes controls capable of assessing whether an agent’s behaviour has departed from the purpose of its task.
The system includes built-in classifiers and allows customers to define additional rules in natural language. These can flag suspicious behaviour for review, but such detection is not equivalent to proof that a model’s underlying intentions or future actions are known.
Risk scoring incorporates the MITRE ATT&CK framework, providing a common structure for describing behaviours associated with known attack techniques. The reliability of those classifications will depend on the observations collected and the conditions encoded in the rules.
A separate kill switch is designed to terminate active agents and their infrastructure connections. This can stop subsequent operations once an issue has been identified, although it cannot reverse every action already completed in a production environment.
Maintaining state without permanent access
Beams includes a mechanism called Phases for preserving selected task state when a runtime expires. Saved artefacts and memory can be transferred to a newly created environment, allowing a task to continue without retaining the original machine and its privileges.
The same capability supports parallel or branching workflows, where separate temporary runtimes explore alternative approaches under comparable isolation controls.
Such mechanisms address a practical difficulty in restricting agent execution: complex workflows often extend beyond a single session and may need to preserve context without keeping the original credentials or runtime available indefinitely.
Teleport says Beams builds on its existing Infrastructure Identity Platform, which the company reports is used by more than 700 enterprises. That figure describes the wider platform and should not be interpreted as the number of organisations already deploying Beams.
The general availability announcement establishes the product’s stated functionality, but does not include independently validated measurements of its ability to prevent compromised agents, reduce administrative errors or detect coordinated malicious behaviour.
Its security model nevertheless defines a distinct infrastructure control boundary: agents receive limited authority through delegated identities, execute within temporary environments and leave records that can be examined after their work has finished.
