Home / Articles / A Mac of the agent's own: a business plan for agent desktops, what Apple's licence allows, and three behaviour policies

A Mac of the agent's own: a business plan for agent desktops, what Apple's licence allows, and three behaviour policies

By Dinis Cruz · 2026-10-09 · v0.7.16 · agentsagent-desktopsmacosbusiness-planagent-behaviour-policylicensingvaultspkisgitwardley-mapsisolationcoworkcomputer-usearticle

Abstract: Our agents already have dedicated resources with a small blast radius: their own mailbox, their own code-host account, their own Claude account. The next one is a desktop of their own, and it should be a Mac, because that is where most agent desktop apps arrive first. This is a business plan for somebody else to build, written after two companies replied with interest to the research behind our earlier article on renting an agent a desktop. It started as a pool of Macs rented by the minute, and Apple's licence rules that out: a leased Mac must be held for at least 24 hours, for developer services, by one customer, and virtual copies may not be time-shared. So the plan is the shapes that are allowed: a dedicated Mac per customer, run for them, with a per-minute meter on top and a clean desktop per run built from encrypted vaults; developer agents on leased Macs; software for the Mac mini you keep; and a request to Apple for terms. The reason to want any of it is in the three behaviour policies: the same customer service agent on your own Mac, on a dedicated Mac and on a hardened one, where the excess nothing bounds falls from 23 rows to 11 to 3.

In short

• The next dedicated resource is a desktop. Our agents already have their own mailbox, their own code-host account and their own Claude account, which in practice is dedicated compute. A desktop of their own is the next step, because I will not run them on my own machine.
• It should be a Mac. Most agent desktop apps arrive on the Mac first, it is the desktop most people already know, and it is the one you cannot rent by the minute today.
• Apple's licence decides the shape. A leased Mac must be held for at least 24 hours, only for developer services, by one customer at a time; virtual copies may not be time-shared. The pool of Macs rented by the minute that I first imagined is not allowed.
• The shapes that are allowed are a dedicated Mac per customer, run for them, with a per-minute meter on top; developer agents on leased Macs; software for a Mac you keep; and a request to Apple for written terms.
• The vaults are the state. Boot a clean Mac, install sgit, hand it one key, clone one set-up vault, and everything else comes from there: profiles, allowlists, the policy, the agent's slice of code and data, and the record of what it did.
• The reason to want it is the behaviour policy. For one customer service agent, the excess over the mandate that nothing bounds is 23 rows on your own Mac, 11 on a dedicated Mac and 3 on a hardened one.

The next dedicated resource

The way we run agents has been moving in one direction: each agent gets resources of its own, with a small blast radius. A dedicated mailbox instead of mine. A dedicated code-host account. A dedicated Claude account, which in practice is dedicated compute. The agent team as it runs shows what that looks like day to day.

The natural next step is a desktop. Claude's desktop app and Cowork are very capable on a desktop, and these days Claude can drive desktop applications well: mail, messages, a browser, creative and video tools. But I do not run agents on my laptop, because everything I have is on it. The agent needs a desktop of its own: one machine, one application, one set-up, holding only what the agent is meant to have.

Why a Mac

Three reasons. The providers of agent desktop apps tend to ship to the Mac first and prefer it, so it is the best environment to be in. It is the desktop most people already know. And it is the one that is hard to get on demand: ironically, Windows and Linux run happily as virtual machines, by the hour, from many places, and a Mac never has been. That gap is the business.

It is also a better place to put controls than a person's own machine. A Mac whose only user is an agent does not need to be usable by a person, apart from a browser for watching it. It can be supervised, profiled, allowlisted and logged far beyond what anybody would tolerate on their own laptop.

What Apple's licence allows

This is where the first version of the idea died, and it is better to say so on the first page than to discover it after building. The research is in the vault, with every clause quoted from Apple's licences for macOS 15, 26 and 27. The short version, and it is a reading, not legal advice:

• Leasing a Mac is allowed only for developer services. Section 3 allows a lease "for the sole purpose of providing Permitted Developer Services", defined as "continuous integration services, including but not limited to software development, building software from source, automated testing during software development".
• For at least a day, to one customer. "Each lease period must be for a minimum period of twenty-four (24) consecutive hours", and the customer must have "sole and exclusive use and control" of the software and the hardware.
• Virtual copies are limited, and may not be time-shared. Up to two additional copies in virtual machines on a Mac you own or control, for software development, testing, macOS Server or personal, non-commercial use, and not "in connection with service bureau, time-sharing, terminal sharing, relay service or other similar types of services".
• One user at a time. "Only one user may use the Apple Software at a time."
• And one practical limit: a virtual machine's saved state is tied to the Mac it was saved on, so a pool could not move a running desktop between Macs anyway.

So a shared pool of Macs whose desktops are rented by the minute to many customers, for general agent work, is out. Two things soften that. The macOS 27 licence now opens its virtualisation and leasing clauses with "except as otherwise provided in writing, signed, or issued by an authorized representative of Apple", which is a route to written terms for a use Apple wants to support. And an agent desktop used for email or office work, rather than development, is a question for a lawyer before it is a product.

The shapes that are allowed

The plan's recommendation: build A and C, give away E, ask for D, and do not build the pool. Per-minute pricing survives, as a meter on a Mac one customer holds, never as a share of a Mac that others use.

A clean Mac, a key, and everything else from the vaults

The part I like most is how little is new. We already have a great solution for saving state: encrypted vaults. So the desktop needs very little of its own. Boot a clean macOS, install sgit, give it one key, and clone one set-up vault. A small program in that vault does the rest.

The vaults divide the work, the way a supply chain should, with each party holding only its slice:

• A set-up vault: the signed entry program, configuration profiles, the egress and binary allowlists, and the behaviour policy.
• Code and data vaults, each cloned with only the folder the task needs.
• A mandate vault, owned by the customer, which says what the agent is for.
• Keys by PKI. Each desktop has its own key pair; the vault keys it needs are encrypted to its public key and decrypted inside the running desktop, and the private key lives in the desktop's keychain. That is authorisation by encryption, not by privilege, using the PKI already in sgit.
• An audit vault, where every process, network and file event goes as it happens, off the machine.

The vault includes the bootstrap itself, a short readable script. Its key-handling steps were run for this article with sgit 0.20.0 on Linux: a key pair generated, a read key encrypted to it and decrypted, an entry program signed and verified, a tampered one refused. Nothing has run on a Mac yet; the plan says so.

flowchart LR
  subgraph cust["The customer"]
    direction TB
    OWN["Owner<br/>holds the vault keys"]
    POL["Mandate vault<br/>the ABP, the allowlists"]
  end
  subgraph op["The operator: Agent Desk"]
    direction TB
    subgraph host["Apple silicon Mac, dedicated to one customer"]
      direction TB
      VM1["Agent a1 desktop<br/>Claude desktop or Cowork<br/>one user at a time"]
      VM2["Up to two VMs<br/>for development work"]
    end
    PX["Egress proxy and MCP gateway<br/>allowlist, logs"]
    OBS["Observability<br/>process, network, file events"]
  end
  subgraph vaults["Encrypted vaults: ciphertext only on the server"]
    direction TB
    SV[("Set-up")]
    CV[("Code")]
    DV[("Data, scoped per agent")]
    AV[("Audit log")]
  end
  NET["Only the services<br/>the mandate needs"]
  OWN -- "keys, encrypted to<br/>each desktop's PKI key" --> VM1
  POL --> VM1
  VM1 --> SV & CV & DV
  VM1 -- "every request" --> PX --> NET
  VM1 --> OBS --> AV
  VM2 --> PX

sequenceDiagram
  autonumber
  participant U as Customer or scheduler
  participant H as Dedicated Mac: one customer
  participant V as Clean macOS session
  participant K as Key delivery
  participant S as Set-up vault
  participant O as Other vaults
  U->>H: start a desktop for agent a1
  H->>V: erase and boot clean, or clone a golden image for a development VM
  K->>V: this desktop's private key, into the keychain
  V->>V: install sgit, then read the vault key decrypted with the desktop's key
  V->>S: sgit clone the set-up vault, scoped
  S-->>V: bootstrap program, profiles, allowlists, the ABP
  V->>V: apply profiles, start the egress proxy and logging
  V->>O: clone code, data and mandate vaults, each scoped to a1
  Note over V: the agent app starts and works its task
  V->>O: commit and push results and the audit log
  U->>H: stop, then erase or discard
  Note over H: nothing secret stays on the host

Three desktops, one agent

The reason to want any of this is the behaviour policy. The vault takes the customer service agent from Hope or enforcement, the same fictional shop and the same mandate, and puts it on three desktops, writing each as an Agent Behaviour Policy in the published grammar: the grant, the mandate, the delta, and what stands in the way of each row, from none, through an expectation and a setting, to a boundary, which is the only kind that is a control.

• On your own Mac, the behaviour policy is enormous, because the grant is everything you have: your mail, your files, your browser sessions, your keychain, your messages. Nothing is held by a boundary.
• On a dedicated Mac, it is still Claude doing the work, and the policy is already much smaller, because there are no other secrets on the machine. The only secrets are the ones the agent is supposed to have.
• On a hardened Mac, third-party controls do the rest: a standard account on a supervised Mac with profiles it cannot remove, an egress proxy that allows only the mandate's hosts, a binary allowlist, mail through a gateway that allows only the assigned thread and a reply to its sender, and every event streamed to the audit vault. The tools are the kind RiskMandate has written business cases for, and open-source macOS controls.

What is left on the hardened Mac is mostly one thing: the shop's admin screen, which shows every customer. That is a finding about the shop's software, not about the desktop, and it is the kind of finding a behaviour policy exists to produce. One more is a limit of macOS itself: screen recording, which computer use needs, cannot be granted by a profile, so a person has to approve it once, in the image.

The numbers

My own use is the test case: four scheduled runs a day of about half an hour, plus two interactive hours on working days, about 104 desktop hours a month. On the plan's assumptions, a dedicated Mac with the meter costs about £211 a month; a Mac mini bought and run yourself about £119, counting your own time; daily 24-hour leases about £390, using 17% of each day you pay for. The dedicated Mac wins once looking after your own takes more than about four hours a month, and beats daily leases once you need a Mac on more than about twelve days a month. The interesting customer is not the person with one Mac mini; it is the team that would otherwise buy, set up, secure and maintain several, and the team doing browser automation that should not be doing it on anybody's laptop.

The map

wardley-beta
  title Agent Desk: productising the agent's desktop, on parts that are already commodities
  anchor "A business running agents" [0.97, 0.62]
  component "Work done by agents" [0.88, 0.52]
  component "Agent Behaviour Policy" [0.78, 0.34]
  component "Agent desktop, on demand" [0.70, 0.24]
  component "Desktop agent apps" [0.62, 0.62]
  component "Observability and lock-down" [0.52, 0.40]
  component "Credentials by key, PKI" [0.44, 0.36]
  component "State in vaults" [0.36, 0.48]
  component "macOS virtual machine" [0.28, 0.56]
  component "Models" [0.22, 0.76]
  component "Apple silicon Mac" [0.12, 0.86]
  "A business running agents" --> "Work done by agents"
  "Work done by agents" --> "Agent Behaviour Policy"
  "Work done by agents" --> "Desktop agent apps"
  "Work done by agents" --> "Agent desktop, on demand"
  "Desktop agent apps" --> "Models"
  "Agent desktop, on demand" --> "Desktop agent apps"
  "Agent desktop, on demand" --> "Observability and lock-down"
  "Agent desktop, on demand" --> "Credentials by key, PKI"
  "Agent desktop, on demand" --> "State in vaults"
  "Agent desktop, on demand" --> "macOS virtual machine"
  "Agent Behaviour Policy" --> "Observability and lock-down"
  "macOS virtual machine" --> "Apple silicon Mac"
  evolve "Agent desktop, on demand" 0.60
  evolve "State in vaults" 0.72
  evolve "Credentials by key, PKI" 0.66
  evolve "Observability and lock-down" 0.64

What we are looking for

From a company that rents or hosts Macs, or wants to:

• Dedicated Macs per customer, by the day or the month, with an API to erase and re-provision between runs, so a clean desktop per run takes minutes.
• A meter inside, so a customer pays a fixed fee for the Mac and a per-minute price for the desktop time, with a higher price for the first hour or two and a taper after.
• A developer-agent offer, squarely inside the licence: coding agents on leased Macs and in virtual machines.
• A joint approach to Apple for written terms covering agent desktops, which the macOS 27 wording now makes possible.
• The stack, open: the bootstrap, the vault layout, the behaviour policies and the profiles are all in the vault, to take and run. What we would bring is the policies, the vaults, the keys, and RiskMandate to write the policy for each customer.

Where to start

• Read the licence section of the plan first, then talk to a lawyer about your shape.
• Start with shape A or C, where the licence is clearest.
• Write the behaviour policy before the product: it is the argument, and it tells you which controls matter.
• Measure the boot: the plan assumes about five minutes from request to a working desktop; it has not been timed yet.
• Keep state out of the machine: one key in, vaults for everything else, and an erase at the end.

Drafted from a voice memo by Dinis Cruz, who is the author of the idea and the person with editorial responsibility, by agent@riskmandate.ai (Claude Opus 5.5, claude-opus-5-5) in the sgit.ai site session, on 9 October 2026. The licence quotes are from Apple's macOS 15, 26 and 27 licences as published on apple.com; the reading of them is ours and is not legal advice. Mac prices are from Apple's UK store on 9 October 2026; every other number is an assumption, labelled in the vault. No provider is named, at the request of the author.

Want the next issue by email. One issue a week or so: what was published, what it adds up to, and what is worth your time. Subscribe to the SGit Newsroom →

← All articles