AI and privilege after United States v. Heppner: what legal teams should know. Read the analysis →
Platform · 03 · Privilege AI Agent

An EDR sensor for legal compliance.

The Privilege AI Agent runs on company workstations and watches every foreground work window for over 120 categories of compliance, legal, and regulatory violations. Detections flow to Privilege Watch and alert legal and compliance — continuous evidence for ISO 42001, SOC 2, the EU AI Act, and GDPR.

SensorCompany workstations
Coverage120+ categories · 4 queues
AlertsLegal · compliance
FrameworksISO 42001 · SOC 2 · EU AI Act · GDPR
Agent setup: download the Mac agent, enrolled Macs with coverage, last-seen and permissions, and the organization capture policy
Detail · enrolled devicesheartbeat

On the workstation, where the data leaves.

Watch and the privileged workspace see what reaches an AI account. The Agent sees everything else — the paste, the export, the upload — before it becomes a disclosure.

01 · Install in minutes

Download, connect with organization sign-in, grant two permissions.

Apple silicon, macOS 15 or later; Windows 11 by MSI; iOS and Android by MDM. Observation starts once the device is connected and permitted by your organization's policy.

02 · 120+ categories, four queues

Security, Privacy, Employment, Legal — each detection lands in the right review queue.

From sensitive-data egress and access misuse to sanctions, antitrust-sensitive conduct, and regulated-sector obligations. Detections are review suggestions supported by observed evidence, not verdicts.

03 · Coverage you can audit

A heartbeat per device. A capture policy per organization.

A missing heartbeat is a coverage gap, not a finding. The capture policy lists the applications and titles to prioritize; credentials and uncertain surfaces are always excluded. Device administration grants no access to legal content.

In the productAgent setup · Agent detections
Agent detections in Privilege Watch: open, new, needs-context and escalated counts, a 14-day activity chart, and top categories
Where detections landEvery Agent detection is reviewed in Privilege Watch.Review detections from work observed on enrolled devices, alongside the conversation alerts from Claude and ChatGPT.
P Agent for Mac: install on each workstation, Apple silicon, macOS 15 or later, with a Download button
Enrolled Macs: device, coverage, last seen, permissions, and a revoke action per device
FleetDownload, enroll, and see every device's coverage.Last seen, text and screen permissions, and a revoke action per device. Offline is reported as a coverage gap, not a concern.
Top categories in the latest Agent detections: privacy rights, external AI legal advice, contracts, employment decisions, sensitive-data egress
CategoriesNamed the way legal names them.Privacy rights and data governance. External AI legal advice and review bypass. Sensitive-data egress and insider exposure. A detection can match more than one.
Organization capture policy, version 1: the Agent monitors every foreground work window by default; credentials and uncertain surfaces are always excluded
Default scopeEvery foreground work window
Guidance fieldsApplications · title fragments to prioritize
Always excludedCredentials · uncertain surfaces
Access to legal contentNone, from device administration
Capture policyOne versioned policy per organization.The fields are guidance, not an allowlist — the Agent watches work windows by default and never credentials.

Evidence for the frameworks you answer to

Continuous detections and a weekly evidence pack instead of a scramble before the audit.

AI governanceISO 42001AI use inventoried, approved, and evidenced per workstation.
SecuritySOC 2Monitoring and change-control evidence for the trust services criteria.
RegulationEU AI ActWhich systems are in use, by whom, on what data.
PrivacyGDPRPersonal data reaching unapproved processors, caught at the endpoint.
Specification

Monitors company workstations. Alerts legal and compliance.

Deployed by IT. Read by legal and compliance.

SensorCompany workstations · foreground work windows
Coverage120+ violation categories · Security, Privacy, Employment, Legal queues
AlertsLegal · compliance · recorded on the matter
FrameworksISO 42001 · SOC 2 · EU AI Act · GDPR
InstallmacOS 15+ (Apple silicon) · Windows 11 MSI · iOS and Android by MDM
PermissionsScreen Recording · Accessibility · organization sign-in
ExclusionsCredentials and uncertain surfaces, always
Available onWeb console · Windows · Mac · iOS · Android
United States v. Heppner · AI & legal privilege

Give legal context from the workstation.

A policy is easier to act on when teams can see potential exceptions. The Agent adds visibility into supported activity on enrolled workstations and sends detections to Watch for review. Pair that operational evidence with counsel’s legal assessment when sensitive material enters an unapproved workflow. Monitoring evidence supports governance; it does not make the observed activity privileged.

Put a sensor on the endpoint.
Hand legal the evidence.