Building a desktop agent people don’t hate

The budget that shapes everything

Our hard limits are 1% average CPU, 150MB resident memory, and no measurable impact on battery or fan noise. These are not aspirations; the release pipeline fails builds that exceed them on our reference hardware, which includes a 2019 laptop with 8GB of RAM, because that is what real fleets look like.

The budget forced most of our architecture. We poll the foreground window at a coarse interval instead of hooking window events on every platform, because event hooks are cheaper until a pathological app fires thousands of them per second. We learnt that from a customer whose CAD software did exactly that.

Being cheap is a trust feature, not just a performance one. The fastest way to make employees hate an agent is a hot laptop. People forgive a lot; they do not forgive fan noise they can attribute to being watched.

What we refuse to collect

The agent does not capture keystrokes, screen contents, screenshots, clipboard data, file contents, browsing history beyond app-level classification, or camera and microphone input. Not disabled by default. Not collected. The code paths do not exist, which means no configuration mistake, subpoena, or over-eager administrator can turn them on.

This was a deliberate architectural decision in 2024 and it gets re-litigated every year when a prospect asks for screenshots. We decline the revenue. Data you never collect cannot leak, cannot be misused by a bad manager, and cannot appear in a breach notification. Absence is the strongest security control we ship.

What we do collect is narrow: foreground application identity, window title hashes for classification, activity presence, and timestamps. The employee-facing transparency panel shows the actual payloads queued for upload, byte for byte. Several works councils have audited that panel. It exists precisely so they can.

Idle detection is harder than it sounds

Naive idle detection, no input for five minutes, misclassifies half of real work. People think while reading. They sketch on paper. They sit in video calls without touching the keyboard for forty minutes. Early versions of our agent marked a customer’s entire design-review culture as idle, which was both wrong and insulting.

The current heuristic blends input recency with application context. A video-conference app in the foreground with an active audio session counts as engaged regardless of input. A document that has been scrolled recently earns a longer grace window than a dashboard that hasn’t. Full-screen presentation modes get their own rules.

We validated the heuristics the only honest way: diary studies. Forty volunteers across three customers logged their actual activity for two weeks, and we scored the agent against their logs. First pass agreed 71% of the time. The shipping version agrees 93%, and the remaining gap is dominated by thinking-while-staring, which we classify conservatively as engaged.

Designing for the network you don’t control

Corporate networks are hostile in mundane ways: SSL-inspecting proxies, captive portals, VPNs that flap, laptops that sleep mid-upload. The agent therefore treats connectivity as an occasional gift. Everything writes first to a local, size-capped, encrypted queue; uploads are opportunistic, batched, and idempotent.

The queue holds fourteen days of data in under 40MB because we aggregate before we store. If the cap is hit, we degrade resolution rather than drop days, coarsening old entries from minute-level to hour-level. A fortnight offline on a fieldwork laptop syncs in one compressed burst when it finally sees Wi-Fi.

Idempotency keys on every batch mean retries can never double-count an hour of work. That sounds obvious. We nevertheless shipped a duplication bug in 2022 that briefly credited one Melbourne accountant with a 31-hour day, and the postmortem for that incident is why every payload now carries a content hash the server deduplicates on.

The machine-approval workflow

An agent that silently appears on someone’s machine has already failed, whatever it collects. Our enrolment flow requires two parties: IT provisions the install, and monitoring stays dormant until the machine is explicitly approved into a workspace, with the employee shown what will be measured, in plain language, on first run.

The dormant state is real, not cosmetic. Before approval the agent collects nothing and its queue is empty; the transparency panel proves it. Admins see a pending-machines list and approve deliberately, which also solves a fleet-hygiene problem nobody mentions: without an approval gate, build servers, kiosks, and test VMs pollute your analytics within a month.

Revocation is symmetric. Off-boarding a machine wipes its local queue and tombstones its history according to the workspace retention policy. We built that before any customer asked, because we knew the first GDPR erasure request would arrive eventually. It arrived in 2023, from a French customer, and took eleven minutes to honour.

Shipping updates without breaking IT

Enterprise IT teams have update policies for good reasons, and an agent that silently self-updates violates most of them. We ship signed MSI and PKG packages deployable through Intune, Jamf, and their relatives, with a self-update channel that admins can pin, stage, or disable entirely. About 40% of our fleet runs admin-pinned versions.

That means we support every release for eighteen months, which is expensive and non-negotiable. The wire protocol is versioned and additive-only; the server speaks to every agent version in the support window. We test each release against a lab of endpoint-protection suites, because nothing torches trust faster than a security product quarantining you on 4,000 machines simultaneously.

Rollouts go in rings: our own machines for a week, then 1% of consenting fleets, then wider. The 2024 incident where a Windows timer regression cost some users 3% CPU was caught in ring one, on my own laptop, by our budget monitor. The pipeline works when it embarrasses you privately.

Boring on purpose

After four years, our strongest engineering conviction is that an agent should be forgettable. No pop-ups, no gamification, no nudges interrupting the very focus we exist to measure. A menu-bar icon, a transparency panel for anyone curious, and silence otherwise.

The metric we watch internally is uninstall-and-complaint rate per 10,000 machines per month. It has fallen every year since 2022. Not because people love monitoring software. Because the agent costs them nothing they can feel, hides nothing they can find, and collects nothing they would object to if they looked.

That is the whole trick, and it took us four years to learn there isn’t another one.

Writes for The Signal about engineering and the future of measurable, humane work — drawing on anonymised patterns from the teams and focus hours analysed on Momentum.