Before any technical step
Prerequisites, not parallel workstreams.
Endpoint monitoring deployed without these is a legal exposure that no amount of privacy architecture repairs. This is not legal advice and your counsel owns the decision.
- 01
Employee monitoring notice
Several US states and most EU member states require advance written notice.
- 02
Works council consultation
Required in several EU countries before rollout — and it takes longer than the technical deployment.
- 03
A documented DPIA
If you operate under GDPR. The redact-then-report design is the core of that argument, which is why it is worth documenting formally rather than assuming.
- 04
Published scope limitation
Company-owned devices, company accounts, business use. Transparency reduces legal risk and materially improves adoption.
Packaging
One installer per platform, through the MDM you already run.
The browser extension is force-installed separately via enterprise browser policy, so it is not removable by the user and does not depend on anyone running an installer.
Permissions: the base configuration needs none beyond running as a service. Elevated permissions on macOS are required only for the optional clipboard fallback — the noisiest and least essential capture path. Most deployments leave it off.
| OS | Mechanism | Deployed by |
|---|---|---|
| macOS | Signed and notarised package, background service | Jamf, Kandji, Intune |
| Windows | Windows Service | Intune, GPO |
| Linux | systemd unit, .deb / .rpm | Ansible, Puppet, Chef |
Staged rollout
Stage three is the one people skip, and the one that matters.
If employees click through warnings at a high rate, blocking will be circumvented rather than obeyed — they will use a phone, or a tool you do not cover. A high click-through rate is a signal to fix precision, not to escalate enforcement.
| Stage | Duration | Mode | What you are looking for |
|---|---|---|---|
| 1 · Pilot, one department | 2–4 weeks | Log only | False-positive rate against real traffic; coverage health |
| 2 · Tune | 1–2 weeks | Log only | Exception lists, thresholds, context terms |
| 3 · Warn | 2–4 weeks | Warn | Click-through rate — whether warnings still mean anything |
| 4 · Block, high-confidence only | ongoing | Block | Enforcement without eroding trust |
| 5 · Expand scope | ongoing | Per department | — |
Verifying it works
Installed is not the same as binding.
After deployment, confirm in the console: devices reporting heartbeats versus silent devices; capture paths bound on each supported AI tool rather than merely installed; synthetic canary events completing the full path; and the deadline-exceeded rate within budget.
Removal is MDM-driven and verifiable — the agent reports its own removal, and the console shows the device transitioning to an uncovered state rather than simply going quiet.
Straight answers
What permissions does the agent need?
The base configuration runs as a background service and needs no special privileges. Full Disk Access or Accessibility on macOS is required only if you enable the optional clipboard and window-title fallback — the noisiest and least essential capture path. Most deployments leave it off.
How long does a pilot take?
A log-only pilot on one department is typically the first two to four weeks. That window exists to measure the false-positive rate against your real traffic before any warning or blocking is switched on.
What has to happen before technical deployment?
Employee monitoring notice, and in several EU countries works council consultation. Under GDPR a DPIA should be documented. These are legal prerequisites, not paperwork to run in parallel.