Automatic updates
Native installers support automatic updates. You never need to reinstall the agent to get a new version.
When a device is offline
The agent keeps enforcing the last signed policy it received. Events are stored and reported when the device reconnects.
Policy changes
When an admin changes policy, devices pick it up on their next policy pull. Every policy bundle is signed with Ed25519 and verified on the device before it is enforced.
Uninstalling
Uninstalling requires admin approval, and the uninstall is recorded in the console. An employee cannot quietly remove protection.