Explicit consent
Every support session requires local user acceptance.
Secure remote support
Consent-bound remote support.
Authorized administrators can request a view-only endpoint session. Desktop control, clipboard, and file capabilities are not enabled.
Session guarantees
Always visible
Active support remains clearly indicated with a local Stop control.
Fail closed
Authorization, revocation, and auditability take priority over availability.