Action Registry Terms

These Product Terms apply to the Beam Action Registry and plug into the Beam General Terms. They apply both to Customers who consume Action packages and to Publishers who publish them. Capitalised terms not defined here have the meaning given in the General Terms.

1. Customer Responsibilities

1.1 Consuming Actions

Customer is solely responsible for:

• evaluating any Action package before invoking it, including packages published by third parties;
• the Trust Level it permits its workloads to run, and the consequences of permitting packages beyond those Beam publishes or has reviewed;
• the data and credentials it passes to an Action package, which the package may be able to read; and
• pinning and reviewing package versions where reproducibility matters.

1.2 Publishing Actions

Publisher warrants and is solely responsible for:

• holding all rights necessary to publish and license the package, including rights in any third-party or open-source components it includes;
• the accuracy of the package manifest, including its declared permissions and behaviour;
• ensuring the package does not contain malware, exfiltrate data, or perform undisclosed actions; and
• the security and maintenance of published versions.

Publisher grants Beam a non-exclusive, worldwide licence to host, store, reproduce, and distribute the package through the Registry, and to display its metadata, for as long as it remains published.

2. Trust Levels

Beam assigns each Action package a Trust Level. A Trust Level describes the provenance and review status of code. It is not a statement about the identity, legal standing, or trustworthiness of a publisher, and it is not a warranty that a package is fit for Customer’s purpose or free of defects.

Beam may reclassify or block a package at any time, including where it presents a security risk or breaches these terms, and may do so without prior notice where the risk warrants it.

3. Data Retention

3.1 Published packages

Published package versions and their metadata are retained while published. Because others may depend on a published version, Beam may retain and continue to serve a version after a Publisher requests its removal, where withdrawal would break dependent workloads, except where removal is required for legal or security reasons.

3.2 Registry records

Publication, version, and classification records are retained for as long as the account is active and thereafter as required for audit and legal purposes.

4. Additional Definitions

“Action” means a packaged unit of functionality that may be invoked by a Beam workload.

“Publisher” means the party that publishes an Action package to the Registry.

“Trust Level” means the classification Beam assigns to an Action package describing its provenance and review status.

“Registry” means the Beam Action Registry and the interfaces through which packages are published and retrieved.