Larry Ellison described an outcome. The part nobody is mapping is the architecture it actually requires.

At Oracle's September 2024 financial analyst meeting, Ellison described a future where 'citizens will be on their best behavior, because we are constantly recording and reporting everything that is going on.' He framed it as AI continuously analyzing data from security cameras, police body cameras, doorbell cameras, and vehicle dashboard cameras, with a central system flagging problems in real time. The phrase 'best behavior' is the one that went viral. The architecture behind the phrase is what nobody in the coverage picked apart.

Ellison's pitch requires four primitives to work the way he described it. One, continuous video upload from every camera to a central analysis cluster, because reporting 'everything' means the cloud has to see everything. Two, identification models running at scale, because naming who is on camera is what separates 'surveillance' from 'detection.' Three, a centralized cross-camera index, because a single view of a citizen across city, highway, and storefront only exists if the data all lands in one place. Four, network access to each camera feed, because cloud inference cannot run on signals it cannot reach. A monitor-first edge system like Cyrano implements none of these: it reads a composite HDMI frame at the DVR, runs inference on the property, sends about 240 KB per delivered event over cellular, and does not cross-correlate between properties.

On a 1920 by 1080 HDMI multiview rendered as a 5 by 5 grid of 25 camera tiles, each tile is 384 by 216 pixels. A person standing 30 feet from a camera occupies roughly 36 pixels of vertical height in that tile. That is enough to reliably detect the silhouette class 'person,' and not enough to run a face recognition model with useful accuracy. The empirical floor for reliable face ID is around 80 to 100 pixels between the eyes. A 36-pixel-tall person has roughly a 6 to 8 pixel interocular distance. The pixel budget is not a setting you can change. It is a property of the input architecture (read the monitor, not the cameras). An edge system built on this input cannot identify, only classify. That is an architectural guarantee, not a policy promise.

Per delivered HIGH event: an 18 KB JPEG thumbnail, a 220 KB H.264 clip of roughly six seconds bracketing the detection, and a 612 byte JSON metadata object. Total around 240 KB per event. Uplink is a 4G cellular modem with an eSIM. No continuous upload. No property Wi-Fi or Ethernet involvement. No face embedding. No license plate string. No audio. The raw 1920 by 1080 multiview never leaves the building. That egress contract is the thing a property manager can sign that an Ellison-style cloud pipe cannot sign, because continuous cross-camera analysis requires continuous upload.

No. And this is the part most critique of AI surveillance misses. A system's capability ceiling is set by its input pipe, not its software. A monitor-first unit's input pipe is a single HDMI signal from the DVR; its uplink is a cellular modem billing by the megabyte. Those two facts together cap the system at event egress and class-level detection forever. To do Ellison-style identification and centralized analysis you would have to swap the input (HDMI to RTSP per camera), swap the uplink (cellular to building fiber or fixed circuit), and add a cloud fleet. That is not a firmware update. That is a new product. If the question is 'is the privacy posture load-bearing,' the answer is yes: the architecture is what enforces it.

No. Edge is a tradeoff, not a moral position. Ellison-style centralized analysis is the right architecture for some workloads. Cross-jurisdiction cold case investigation, a citywide missing-person search, and federated threat detection across tens of thousands of cameras are workloads that require a centralized index, and an edge system cannot do them. The honest framing is: pick the architecture whose capability ceiling matches the workload, because the ceiling is what you are signing up for on day one. A property that wants 'catch people running across a compactor zone at 2 AM' does not need Ellison's stack. A state-level criminal investigation across millions of cameras does, and that is a different sort of accountability problem.

It is a load-bearing property of the device. Here is the testable version: unplug the cellular modem and the Cyrano unit can no longer communicate outbound at all. No event leaves. Nothing crosses the property boundary, ever. The same device with RTSP per-camera input and a cloud uplink would still be reading every camera over the LAN and could be reconfigured to upload continuously. The input pipe bounds what is possible, not just what is intended. 'Monitor-first' is not a branding choice. It is an architectural constraint that decides the ceiling of the device's possible behavior.

Because 'AI surveillance is coming' and 'AI surveillance is centralized' are two different claims, and only one of them is inevitable. Class-level detection on cameras (person in zone, vehicle in zone, package on doorstep) is going to be everywhere and is genuinely useful. A panopticon that cross-correlates identity across every camera in a city requires someone to actually build and operate the centralized index, and the decision to build it is a policy decision that happens per vendor. Edge systems make that policy decision visible by refusing to participate in the index. Choosing one vendor over another is how property managers register that preference at the procurement level, which is where most 'AI surveillance' decisions actually happen in the real economy.

Four architectural questions. One, what exactly leaves my building per hour of normal operation, in bytes and in kind? If the answer includes continuous video upload, you are buying an Ellison-style system. Two, what models run on my premises versus in a central cluster? Edge inference stays at the property; cloud inference does not. Three, can my property be correlated with other properties in this vendor's index, and if so, what is the opt-out? If there is no opt-out, you have signed a centralization decision. Four, what is the physical input to the AI, and what is its pixel budget? A 384 by 216 tile cannot identify, no matter what the marketing says. Those four answers tell you which architecture you bought, independent of the vendor's stated capabilities.

Not as a political statement. As an engineering one. Ellison described a specific architecture (continuous recording, centralized analysis, identification-grade cameras) and a specific outcome ('citizens on their best behavior'). An edge-based monitor-first system occupies a different point on the same design space: deterministic alerting on class-level events, no continuous upload, no centralized cross-property index, no identification. Both architectures have legitimate use cases. The only dishonest thing would be to claim either architecture is the other. A property manager choosing between them is choosing an egress contract, a pixel budget, and a trust model, all three at once.