Endpoint security
A laptop is an asset with a serial number. The agent binds that serial to a Presence Session, and locks the screen when presence fails or when the epoch moves.
The lock screen is an enforcement point, not a screensaver.
Both agents are thin, auditable, and deployed through the device management platform you already run.
The agent's job is narrow: know which principal is present, know which session that maps to, and refuse to yield the desktop when either answer goes stale. It is not a telemetry product and it does not ship your keystrokes anywhere.
Timers are policy, not constants compiled into the binary. Idle and lock thresholds arrive with the policy pack and take effect on the next push, so raising the posture for a floor does not require a fleet redeployment.
Off the estate, physical signals are undefined and the agent says so rather than guessing. A laptop on hotel wireless holds a logical-only session: it still locks on idle, and it cannot satisfy a rule that requires physical presence, such as reaching an on-premise jump host.
- macOS
- Root daemon on the EndpointSecurity framework
- macOS extensions
- None. No kernel extension is installed
- Windows
- Service plus a Credential Provider
- Enrollment
- Hardware-attested, re-attested every 24 hours
- Transport
- Mutually authenticated to the site broker
- Off-site
- Long-poll over HTTPS, idle lock only
- Heartbeat
- 15 s, three misses marks the device stale
- Desk camera
- Opt-in, and refused without a recorded legal basis
Four states, and one of them is terminal.
A revoked device does not present a password field. There is no path back through the lock screen while the epoch is stale.
PRESENTA live signal inside the window. The desktop is usable.
IDLENo live signal past the idle threshold. Dimmed, with a warning.
LOCKEDIdle past the lock threshold, or a foreign face, or a contaminated portal session.
REVOKEDAn epoch moved. The session is logged off and unlock is denied outright.
What counts as somebody being there.
Liveness is a weighted fusion of cheap signals, not a camera staring at an employee all day. Every optional signal is off until it is deliberately turned on with a recorded basis.
| Signal | Source | Default weight | Required |
|---|---|---|---|
| Input activity | Keyboard and pointer inside the idle window | 0.35 | Always on |
| Badge proximity | Low-energy radio advertisement from the same credential | 0.25 | Optional |
| Self match | Occasional 1:1 face check, embedding discarded immediately | 0.30 | Opt-in |
| Session integrity | Desktop unlocked, agent heartbeat live, epoch current | 0.10 | Always on |
| Foreign face | A face matching a different enrolled principal | Hard flag | Opt-in |
Two operating systems, one session protocol.
macOS
A root launch daemon subscribes to the EndpointSecurity framework. There is no kernel extension to approve and nothing to break on the next major release.
Locking goes through the platform's own immediate-lock path. If the lock cannot be applied, the agent is permitted to deny process execution instead of failing quietly.
Default liveness is input activity, with optional badge proximity and idle detection. The camera at the desk stays off unless it is explicitly enabled.
Windows
A service pairs with a Credential Provider, so presence is evaluated at the point of unlock rather than after the desktop is already exposed.
Unlock is permitted only when the session is admitted, present, or degraded, and the device epoch matches the control plane. A revoked device hides the credential tile and logs the session off.
On elevated threat classes, platform protections such as virtualization-based security can be made a precondition of unlock rather than a recommendation.
Three missed heartbeats mark a device stale, which withholds new resource grants. The desktop session already open is left alone. Remote locking on network flap only happens at the highest threat class, because locking somebody out of an offline laptop protects nobody.
The cases that usually get skipped.
Shared workstations
Devices held by a team bind any principal valid for that zone.
A different person sits down
A foreign face in the desk polygon locks the screen where the camera is enabled.
Unmanaged devices
Short-lived tokens only. No desktop session is issued.
Contaminated entry
A tailgated portal session forces a lock and requires local re-authentication.
Step-up
After a foreign-face lock, or at elevated threat, local credentials alone are not enough.
Linux
The session protocol is operating-system agnostic. A Linux agent is a follow-on.
Related
Bring the door onto the same epoch as the laptop.
We will walk you through a live portal, a compiled policy pack, and a revocation that closes the turnstile and locks the screen while you watch.