Judge actions with any LLM or decision service

beam judge asks a model you choose to review an AI agent's proposed action before it runs. It works like Jev action judging but isn't tied to one provider. Use a general LLM behind any OpenAI-compatible endpoint, or your own decision service: an internal policy engine, a classifier, or a fine-tuned model behind an API.

Choose a provider

# General LLM on OpenAI. The default model is gpt-4.1-nano; pipe the key from a secret manager.
op read op://vault/openai/key | beam judge configure --provider llm --key-stdin

# A local model: no key, and nothing leaves the machine
beam judge configure --provider llm --url http://localhost:11434/v1 --model llama3.2

# Your own decision service, enforcing
beam judge configure --provider http --url https://decide.internal.example/v1/check --mode enforce

Run beam judge status to see the settings without exposing the key, and beam judge disable to stop checks and remove a stored key.

Decision service contract

Beam sends one JSON request per eligible action:

{ "version": 1, "action": { "agent": "claude-code", "tool": "Bash", "input": { "command": "kubectl delete ns prod" } } }

Requests made by beam judge check can also include a short context string from the action file. Your service answers with a verdict and an optional reason. A decision field is accepted in place of verdict:

{ "verdict": "review", "reason": "Deletes a production namespace." }

If a key is configured, it arrives as Authorization: Bearer <key>. Redirects aren't followed, and responses over 64 KB are rejected.

Safety behavior

• Redaction: the same as Jev. Known credential patterns, sensitive field names and your policy's custom detectors are removed before sending. Redaction is heuristic, and tool arguments can still contain private source or data.
• What counts as allow: only an explicit allow verdict. A general model's refusal becomes review. A malformed, missing or oversized answer, a failed request or a timeout becomes error.
• Enforcement: blocks an action on review, deny or error. Observation never blocks.
• Timeouts: 3 seconds by default; set --timeout-ms from 500 to 15000. Each eligible pre-tool call waits for the verdict.
• Self-protection: agents can't run beam judge configure or beam judge disable, and the config file ~/.beam/judge.json (mode 0600) is protected like other Beam files.

Jev and beam judge can both be enabled. Each runs on its own, so their waits add up.

Test a decision

Use the same action file format as beam jev judge:

beam judge check action.json --dry-run   # print the redacted request locally
beam judge check action.json             # exit 0 allow, 2 review or deny, 1 error

The command reports the configured provider's verdict and never executes the action.