What leaves your account
Two flows report on your Studio deployment to Prometheus Research Labs: the licence heartbeat and usage events. Both are opened from inside your account to one fixed host, both are signed in each direction, and neither carries a prompt, a document, a query result or a file. This page lists every field, explains what happens when the Console cannot be reached, and then lists every other connection that crosses your account boundary and what it carries.
Who this is for
Security engineers and data-protection reviewers who need the complete list of what crosses the boundary. The administrator's view of licences is Console: licences, usage and billing.
Before you start
Three terms: the licence id is the public aalk_<id> identifier of your licence key; the licence secret is the 32-byte key the Console reveals once inside the licence token and that Studio stores in your Secrets Manager; the Console host is telemetry.api.alphaagent.prometheusrl.com, compiled into the runtime and not read from any setting.
Flow 1: licence activation and heartbeat
Activation happens once, when agent-runtime first starts with a licence token, and again only if an operator re-activates. POST /v1/license-keys/<licence id>/activate carries:
| Field | Value |
|---|---|
runtime_version | The Studio version |
host_fingerprint | The ECS task ARN (or hostname) of the runtime task, so a licence reused on a second deployment is detected |
deployment_kind | aws |
metadata | The Python version and platform string |
The Console marks the licence active, records the version, fingerprint and kind on the licence, and returns {license_id, status, activated_at, server_time, next_check_period_end} plus a key the runtime uses to open its packaged prompts. A revoked licence is refused with 410. The fingerprint is stored so that operators can see when a licence was last activated and from which host.
Heartbeat. Every 300 seconds while healthy, and every 30 seconds while not, POST /v1/license-keys/<licence id>/heartbeat carries a body of two fields:
| Field | Value |
|---|---|
timestamp | The current time, ISO 8601 |
version | The Studio version |
Every request on this channel, activation, heartbeat and usage alike, carries six headers: the licence id, a timestamp, a one-time nonce, an attestation field (empty on AWS), a key id, and an HMAC-SHA256 signature over the method, path, timestamp, nonce and body computed with the licence secret. The Console refuses a request whose timestamp is more than 300 seconds off, whose nonce it has seen in the last 600 seconds, or whose signature does not verify.
The heartbeat response is one of three shapes:
| Shape | Fields | What Studio does |
|---|---|---|
| Valid | status: healthy, license_valid: true, next_check_period_end, optional warnings[] and enforcement_status | Serves normally; a warning shows an amber "Billing alert" banner |
| Hold | status: enforced, license_valid: false, block: true, recoverable: true, reason, message, enforcement_status | Blocks, recoverable; retries every 30 seconds |
| Lifecycle | status: unhealthy, license_valid: false, block: true, recoverable (false only when revoked), reason, message | Blocks; a revoked licence is a sticky stop |
Flow 2: usage events
Every model call made by the metered services (agent-runtime, knowledge-base, knowledge-base-mcp and data-connector) produces one usage event, written first to the alphaagent-runtime-metering-outbox table in your account and then delivered to POST /v1/usage by a drainer that runs every 5 seconds in batches of 25. Delivery never blocks an agent. One event carries:
| Field | Value |
|---|---|
schema_version | 2 |
event_kind | One of sixteen kinds (below) |
billable | true for fifteen kinds; false for stream_metadata |
prompt_tokens, completion_tokens, total_tokens, cache_read_tokens, cache_write_tokens | Token counts from the model response |
model | The Bedrock model id that was called |
timestamp, occurred_at | When the call happened |
idempotency_key | <execution id>:<event kind> (hashed when long), so a retried event is counted once |
tenant_id, license_id, deployment_id | Your Console account, your licence key, the Organisations deployment id |
agent_id, execution_id, conversation_id, run_id | Identifiers of the agent and the run that produced the call |
user_id | The principal that caused the call: a Cognito subject, apikey:<key id> for a programmatic run, or service:<name> for a background task |
region, zone | The deployment region and its inference zone (us or eu) |
agent_version, metadata | The agent version; small structured metadata |
The sixteen kinds are coordinator_turn, worker_node, governor, context_summary, thought_map_summary, viz_contract, coder_analysis, workflow_condition, pii_redaction, stream_metadata (not billed), kg_build, kg_edge_discovery, kg_embeddings, kg_retrieval, connector_guide and connector_auth_inference. Each names the part of the product that made the call and carries counts only. Nothing on this channel can reconstruct what an agent was asked or what it answered. The Organisations console's Analytics view (By activity) labels them Coordinator turn, Worker node, Governor, Context summary, Thought-map summary, Visualisation contract, Coder analysis, Workflow condition, PII redaction, Stream metadata, Knowledge-graph build, Knowledge-graph edge discovery, Knowledge-graph embeddings, Knowledge-graph retrieval and Connector guide; two further labels, Stream turn (legacy) and Graph step (legacy), mark events from earlier releases.
On the Console side, events land in a raw table and roll up into hourly aggregates per licence and model. Once an hour, the Console reports the billable prompt tokens of your account to AWS Marketplace with BatchMeterUsage on the prompt_tokens dimension of your agreement. That report is the third and last hop, and it is from us to AWS, not from you.
Delivery outcomes: a 200 or 201 marks the event done; a 410 (billing period already closed) drops it; a 402 (licence on hold) defers it until the licence is active again; a 5xx retries with backoff from 5 seconds to a cap of one hour.
Fail-closed behaviour
Studio depends on a good heartbeat to serve. The runtime holds one of these states:
| State | Entered when | Effect |
|---|---|---|
| Starting | Boot, before the first heartbeat resolves | Serving; a watchdog trips if no good heartbeat arrives within 720 seconds |
| OK | A signed response with license_valid: true | Serving; heartbeat every 300 seconds |
| Blocked (recoverable) | The Console is unreachable, answers an error, returns an unsigned response, or returns a hold | Every product route answers HTTP 451; heartbeat retried every 30 seconds; clears on the next good response |
| Killed (sticky) | A response signature does not verify, or the Console reports the licence revoked | HTTP 451 on every product route; heartbeats stop; cleared only by a restart or re-activation |
While blocked, /health, /license/state and /license/activate stay reachable so an operator can see why. The Studio web app polls /license/state every 20 seconds and shows the banner:
Service halted followed by the Console's message, or by default "AlphaAgent cannot reach the AlphaAgent Console and has been disabled. Contact your administrator."
What recovers it: restore outbound HTTPS from the private subnets to the Console host, or have the hold lifted. The deployment resumes on its own at the next good heartbeat; usage that queued while blocked is delivered afterwards. Nothing in your account is switched off from outside; the runtime decides for itself from what the signed response says.
Why a mock Console cannot unblock a deployment
- The host is compiled into the runtime. No setting, secret or environment variable changes it.
- Every heartbeat and activation response must carry two signatures: an HMAC with the licence secret, and an Ed25519 signature (
x-aalk-resp-sig-ed25519, with a key id) that the runtime verifies against public keys compiled into the release. A response without the Ed25519 signature blocks the deployment (recoverable); a response whose signature fails verification kills it (sticky). - The runtime also refuses any signed 2xx that carries no verdict.
The private signing key exists only in the Console. A new key is introduced by shipping a release that carries both public keys, then activating the new key once the fleet carries it.
What our operations team sees, and what it can do
The Console records, per licence: heartbeat_status (pending, healthy, warning after one or two missed five-minute periods, unhealthy after three), the count of consecutive misses, the last heartbeat time, the Studio version, the host fingerprint and the deployment kind. It also holds the usage rows and hourly aggregates described above, and an audit event for every activation, heartbeat and missed period.
What an operator can do is set an enforcement_status on a licence from a separate operations API: billing_suspended, suspended_manual, terms_violation, security_hold, trial_expired, decommissioned and maintenance block the deployment with the message in the table below; payment_overdue_warning only shows the amber banner. An operator can also revoke a licence or regenerate its token.
enforcement_status | Message shown in Studio |
|---|---|
billing_suspended | "AlphaAgent has been suspended due to an unresolved billing issue. Contact your administrator to restore access." |
payment_overdue_warning | "A payment on your account is overdue. Please settle it to avoid your AlphaAgent deployment being suspended." (warning only) |
suspended_manual | "AlphaAgent has been suspended by your administrator. Contact your administrator to restore access." |
terms_violation | "AlphaAgent has been suspended pending review of an acceptable-use issue. Contact your administrator." |
security_hold | "AlphaAgent has been suspended as a security precaution. Contact your administrator immediately." |
trial_expired | "Your AlphaAgent trial has ended. Contact your administrator to continue." |
decommissioned | "This AlphaAgent deployment has been decommissioned. Contact your administrator." |
maintenance | "AlphaAgent is temporarily unavailable for scheduled maintenance. Please try again shortly." |
Suspension is a manual action. The Console's billing automation is deployed with automatic enforcement off: a Marketplace agreement ending or a failed daily reconciliation writes an attention marker and an audit row for an operator to review, and does not suspend a deployment on its own.
Everything else that crosses the boundary
These connections leave your account too. None of them carries content from your runs to us.
| Connection | Direction | What it carries |
|---|---|---|
| Agent Store catalogue reads | Studio to Console, same signed channel | A request for the curated catalogue; the response is the catalogue |
| Release catalogue and bundle downloads | Organisations to Console | A signed credential check and downloads of release bundles into your Organisations account |
| Amazon Bedrock | Studio to Bedrock, through the VPC endpoint in the deployment region | Prompts and completions, inside AWS, to your own account's Bedrock endpoint; see Data at rest and in transit |
| Your connectors | Sandbox to your databases, warehouses, APIs, MCP servers and AWS roles | Whatever the agent's code sends to your own systems |
| Web search and browsing | Studio's search service to public search engines and the sites it fetches | The search query an agent formed and the pages it opened, when an agent uses those tools |
| Docker Hub | ECS to Docker Hub at task start | Image pulls for Neo4j and SearXNG; nothing is sent |
| Microsoft Graph | Organisations to your Entra ID tenant | Enterprise Application creation and app-role assignments for your own users |
Steps: verify the channel from your side
- In Studio, open
https://<your app domain>/agent-runtime/license/state. The response showsactivated, the licence id, the runtime version andhealth, includingresponse_signature.scheme: ed25519and the key id that verified the last response. - In CloudWatch Logs, open
/alphaagent/services/agent-runtimeand filter forheartbeat. One entry about every 300 seconds. - In DynamoDB, open
alphaagent-runtime-metering-outbox. Rows move frompendingtodone; a backlog ofpendingrows means delivery is failing. - In the AlphaAgent Console, open the licence key. Heartbeat shows the same cadence from our side, and Usage shows the token counts by kind and model.
What you should see
- No inbound connection attempts from the Console host in your VPC flow logs, if you have enabled them.
- Every outbound request to the Console host is HTTPS on port 443 from the NAT gateway's Elastic IP.
- Usage totals in the Console match the deployment's usage view in the Organisations console, which reads the same outbox table.
Limits
- The heartbeat interval, the fail-closed behaviour and the signature requirement are fixed in the release and cannot be turned off.
- Without NAT egress (or another route to the Console host) a deployment blocks 720 seconds after start.
- A licence can carry an
allowed_egress_cidrslist in the Console; requests from other addresses are refused with a 403 and the deployment blocks.
If something goes wrong
- Banner with the default message: the Console is unreachable or answered unsigned. Check egress from the private subnets and the NAT gateway, then
/license/stateforreason. - Banner with an administrator message: a hold or a lifecycle change. The Console shows the licence's status; contact your Console account owner.
- Organisations jobs fail with
console_unreachable,console_error,console_response_unverifiedorconsole_credential_invalid: the Organisations engine's own calls to the Console failed.orgctl.py doctorre-checks the stored Console credential; see Upgrading Organisations.