# How it works | Teleport Beams

> A visual walkthrough of Teleport Beams. Start with creating an ephemeral micro-VM in Beams Cloud.

**Canonical page:** [https://www.beams.run/how-it-works/](https://www.beams.run/how-it-works/)
**Launch:** November 9, 2026 — [join the waitlist](https://www.beams.run/how-it-works/)

## 01 / Create a Phase

Alice creates a Phase with the Beams CLI:

```bash
tsh phases add
```

Beams provisions a Cloud Hypervisor micro-VM with virtualized networking, delegated identity, and snapshots for the agentic workload. The Phase inherits Alice's delegated `zero-standing-privileges` role before confirmation returns.

## 02 / Inside a Phase

An exploded logical view of the same Phase:

0. Cloud Hypervisor micro-VM  
1. X.509 delegated identity  
2. Container  
   - 2.1 X.509 signer  
   - 2.2 `/home` overlay filesystem  
3. Virtualized network ring beside the container, with Virtual DNS, Virtual network, LLM proxy, and Protocol-Aware Proxy

The container runs inside the VM; exploded spacing is conceptual. Private keys never leave the signer.

## 03 / Phase lifecycle

Distinguish the persistent agent environment from the replaceable beam (underlying micro-VM):

- 12-hour beam rotation while `/home` checkpoints stay retained  
- Recurring base-image builds and rebase to reduce CVE exposure  
- Independent snapshot forks that copy `/home` without transferring private keys  

Restore resumes the captured revision; forking creates an independent instance while the source continues. Workflow improvement is a simulated evaluation step, not a property of snapshots alone.

## 04 / Connectivity

Discover organization and account resources, enroll over IAM and mTLS through the virtual network, route Amazon Bedrock inference through the LLM proxy, authorize scoped Kubernetes/database traffic through the Protocol-Aware Proxy, and capture audit copies concurrently with forwarding. Discovery and the inherited zero-standing-privileges role do not themselves grant access.

## 05 / Delegated identity

Start agents with zero standing privileges. Agents propose execution plans for model or human review according to risk. Only an on-demand executor Beam receives scoped execution access after approval; denials never instantiate an executor or dispatch resource traffic.

## Related pages

- [Home](https://www.beams.run/) ([Markdown](https://www.beams.run/index.md))
- [Pricing](https://www.beams.run/pricing/) ([Markdown](https://www.beams.run/pricing.md))
- [Beams for AWS](https://www.beams.run/aws/) ([Markdown](https://www.beams.run/aws.md))
- [Documentation](https://goteleport.com/docs/beams.md)