Key takeaways
- The agent reports input signals with timestamps, not keystroke content
- The server applies the organization's idle threshold to decide session boundaries
- Changing the threshold stays consistent because boundaries are computed centrally
- Reading, meetings and calls are the classic edge cases to account for
From signals to sessions
The desktop agent notices that the keyboard or mouse was used and reports the fact with a timestamp. It never reports what was typed. Those signals are batched and sent to the API.
On the server, a processor turns the stream into activity, application, browser and idle sessions. A session closes when the gap between signals exceeds the organization's idle threshold.
Why the server decides
If every device applied its own cut-off, changing the threshold would leave history inconsistent: old sessions split one way, new ones another. Because the processor owns the rule, the same raw signals always produce the same boundaries.
The agent still does a local idle check for user experience, for example dimming its tray icon, using the last threshold it was configured with.
Edge cases worth knowing
Reading a long document, sitting in a meeting or watching a training video all look idle to an input-based detector. That is why an active or idle figure is a starting point for a conversation, not a verdict.
Pick a threshold that suits your work. Support roles with constant input can use a short one; design or research roles usually need longer.