User account records

Clerk stores each user's profile, including verified email and phone number, sign-up date, and custom metadata fields set by the application. A Beam agent reads a user's record when a triggering event occurs, such as a support request or a scheduled account review, checking fields like verification status or metadata against an approved rule. Where the rule applies, such as updating a metadata field after a confirmed change elsewhere, the agent writes the update back to the user's Clerk record. Requests to change identity fields such as email or delete an account are routed to a person before anything is applied.

Session and sign-in activity

Clerk records each user's sign-in events and active sessions, including device and last active time. A Beam agent reads this activity on a schedule or when prompted by a security event, checking for patterns such as a session with no activity past an approved inactivity window. Where the rule allows it, the agent can flag or revoke the stale session and note the action against the account. Sign-ins from an unrecognized pattern, or accounts with repeated failed attempts, are routed to a person to review before any session is forcibly ended.

Organization membership

Clerk lets an application group users into organizations with defined roles and membership. A Beam agent reads an organization's member list when a triggering event occurs, such as a new hire added elsewhere or an offboarding request, checking the person's current role against an approved rule. Where the rule covers the case, such as adding a new member with a default role or removing a departed member, the agent updates the organization's membership in Clerk. Role changes involving admin or owner permissions are routed to a person to confirm before they take effect.