Hands typing on a laptop flanked by monitors showing code
Kernel agents and MDM

Endpoint security

A laptop is an asset with a serial number. The agent binds that serial to a Presence Session, and locks the screen when presence fails or when the epoch moves.

macOS EndpointSecurityWindows Credential ProviderNo kernel extensionDeployed by your MDM
500 msRevocation to screen lock on site, p99
4Desktop states, with no undefined middle ground
15 sAgent heartbeat to the control plane
24 hHardware attestation interval
01

The lock screen is an enforcement point, not a screensaver.

Both agents are thin, auditable, and deployed through the device management platform you already run.

The agent's job is narrow: know which principal is present, know which session that maps to, and refuse to yield the desktop when either answer goes stale. It is not a telemetry product and it does not ship your keystrokes anywhere.

Timers are policy, not constants compiled into the binary. Idle and lock thresholds arrive with the policy pack and take effect on the next push, so raising the posture for a floor does not require a fleet redeployment.

Off the estate, physical signals are undefined and the agent says so rather than guessing. A laptop on hotel wireless holds a logical-only session: it still locks on idle, and it cannot satisfy a rule that requires physical presence, such as reaching an on-premise jump host.

Agent profile
macOS
Root daemon on the EndpointSecurity framework
macOS extensions
None. No kernel extension is installed
Windows
Service plus a Credential Provider
Enrollment
Hardware-attested, re-attested every 24 hours
Transport
Mutually authenticated to the site broker
Off-site
Long-poll over HTTPS, idle lock only
Heartbeat
15 s, three misses marks the device stale
Desk camera
Opt-in, and refused without a recorded legal basis
02

Four states, and one of them is terminal.

A revoked device does not present a password field. There is no path back through the lock screen while the epoch is stale.

PRESENT

A live signal inside the window. The desktop is usable.

IDLE

No live signal past the idle threshold. Dimmed, with a warning.

LOCKED

Idle past the lock threshold, or a foreign face, or a contaminated portal session.

REVOKED

An epoch moved. The session is logged off and unlock is denied outright.

03

What counts as somebody being there.

Liveness is a weighted fusion of cheap signals, not a camera staring at an employee all day. Every optional signal is off until it is deliberately turned on with a recorded basis.

SignalSourceDefault weightRequired
Input activity Keyboard and pointer inside the idle window 0.35 Always on
Badge proximity Low-energy radio advertisement from the same credential 0.25 Optional
Self match Occasional 1:1 face check, embedding discarded immediately 0.30 Opt-in
Session integrity Desktop unlocked, agent heartbeat live, epoch current 0.10 Always on
Foreign face A face matching a different enrolled principal Hard flag Opt-in
A foreign face is not a weight. It locks the screen immediately and records an anomaly, because the interesting case is somebody sitting down at a desk that is not theirs.
04

Two operating systems, one session protocol.

macOS

A root launch daemon subscribes to the EndpointSecurity framework. There is no kernel extension to approve and nothing to break on the next major release.

Locking goes through the platform's own immediate-lock path. If the lock cannot be applied, the agent is permitted to deny process execution instead of failing quietly.

Default liveness is input activity, with optional badge proximity and idle detection. The camera at the desk stays off unless it is explicitly enabled.

Windows

A service pairs with a Credential Provider, so presence is evaluated at the point of unlock rather than after the desktop is already exposed.

Unlock is permitted only when the session is admitted, present, or degraded, and the device epoch matches the control plane. A revoked device hides the credential tile and logs the session off.

On elevated threat classes, platform protections such as virtualization-based security can be made a precondition of unlock rather than a recommendation.

A flaky connection is not a security event.

Three missed heartbeats mark a device stale, which withholds new resource grants. The desktop session already open is left alone. Remote locking on network flap only happens at the highest threat class, because locking somebody out of an offline laptop protects nobody.

05

The cases that usually get skipped.

Shared workstations

Devices held by a team bind any principal valid for that zone.

A different person sits down

A foreign face in the desk polygon locks the screen where the camera is enabled.

Unmanaged devices

Short-lived tokens only. No desktop session is issued.

Contaminated entry

A tailgated portal session forces a lock and requires local re-authentication.

Step-up

After a foreign-face lock, or at elevated threat, local credentials alone are not enough.

Linux

The session protocol is operating-system agnostic. A Linux agent is a follow-on.

Bring the door onto the same epoch as the laptop.

We will walk you through a live portal, a compiled policy pack, and a revocation that closes the turnstile and locks the screen while you watch.