How To Set Up An Always-On Agent Mac For Your Business
Set up an Agent Mac in this order: buy a machine you will dedicate to the job, fix the power settings before anything else, encrypt the disk, build the boot chain so everything comes back after a restart, grant the privacy permissions while sitting at the keyboard, put secrets in a vault instead of a file, and then install one scheduled job and let it run for a week before you add another. The guide has the twenty-five steps; this article is about the order and the places people get stuck, because the steps are easy and the sequence is what people get wrong.
Step zero: dedicate the machine
The single decision that determines whether this works is whether the Mac does anything else. If anyone in the office uses it to check email, it will get a software update at the wrong moment, a lid closed, a browser left open eating memory. The Agent Mac has one user account for the agents, no one logs into it to browse, and it lives on power and wired network in a spot where it can sit for years.
The reference machine is a used 2019 27-inch Intel iMac with the RAM upgraded to 72 GB and a 3 TB SSD. A Mac mini M4 is the modern alternative and skips the RAM upgrade. Either works. What you should not do is press a MacBook you also travel with into service and expect unattended operation. If you are still weighing whether to own hardware at all, the Agent Mac vs a cloud server covers that trade before you spend anything.
Power first, always
Before you install a single tool, fix sleep. Every other part of the setup assumes the machine is awake, and the most common early failure is a timer job that never fired because the Mac was asleep at the moment it was scheduled. That is one of the nine rakes in the guide and it cost me real time.
The settings are a short list: system sleep off, disk sleep off, display sleep at fifteen minutes so the screen is not lit all night, automatic restart after power failure on, and Power Nap off so nothing half-wakes and confuses the jobs. Each one is a single pmset command, and the guide explains what Apple's default is and why the default is wrong for this machine. Do this step, then reboot, then confirm the machine is still awake an hour later with the display dark. Only then move on.
Encrypt the disk, then understand the consequence
FileVault on. The Mac holds access to your messages, your contacts, your files, and the credentials your agents use. It should not be readable if someone walks out with it.
The consequence is that after a full power loss the machine restarts and lands at the disk unlock screen, where it waits for a person. This is the one part of unattended operation that macOS will not fully automate, and you should know that going in. A small UPS prevents most of these events. For the rest, the guide has the handling. Do not turn off encryption to avoid the unlock screen.
Build the boot chain
The boot chain is the sequence that runs, in order, every time the machine starts: Redis comes up, a single node entry point launches, secrets are pulled from a vault, the messaging bridge connects, and the timer jobs register. Every piece is a launchd job so the system starts it at boot and restarts it if it dies.
Two rules from the rakes. First, point launchd at a stable binary path, not at whatever your package manager installed this week. A routine update once moved the node binary and the whole chain fell over silently. Second, secrets go in a command-line password manager and get pulled at launch, not written into a plain text file next to the code. The guide uses the LastPass CLI as the keyring; any vault with a CLI works.
Grant the privacy permissions at the keyboard
This is the step that cannot be done remotely, and it is where the Mac earns its place over a server. macOS gates access to Full Disk, Automation, Contacts, Messages, and Calendar behind per-app consent. The agents need some of these. Grant Full Disk Access to one stable binary, the node entry point, rather than to a dozen shell scripts. A rake here: grants on bash wrapper scripts do not behave the way you expect, and the Automation consent for controlling other apps has to be clicked by a person physically at the machine. Plan one session at the keyboard to get through them all.
Lock it down
Nothing listens on inbound ports. The agents reach out to the services they use; nothing on the internet reaches into the Mac. Firewall on. No remote login unless you specifically need it from inside your own network, and if you do, keys not passwords. The security story for this machine is short because the surface is small, and you should keep it that way rather than opening ports for convenience.
Install one job and wait a week
The temptation after setup is to install everything at once. Do not. Install one scheduled operation, the morning status sweep is the right first one, and point it at your inbox or your Telegram. Then leave the machine alone for a week. If the sweep arrives every morning at the same time without you touching anything, the power settings, the boot chain, the timers, and the delivery path all work. If it misses a day, you have exactly one thing to debug.
After a clean week, add the next job. The guide's health check is the pass condition: a short script that confirms every piece of the chain is running and every timer is registered. Run it after each change. What the machine does once it is fully loaded is in what an always-on Agent Mac does, shift by shift.
Hand the setup to your agent
The guide ships with a skill file. You give it to your agent and the agent does the configuration steps: the pmset commands, the launchd plists, the directory layout, the health check. You do the parts macOS insists a human do, which is the privacy grants and the FileVault unlock. For most owners that turns a weekend project into an afternoon where you mostly watch and click approve. If you are still deciding whether any of this is for you, start at what the Agent Mac is and why run agents on one.
FAQ
How long does the setup take?
An afternoon if you follow the checklist and have the machine in front of you. Most of the time goes to the privacy grants and to waiting on the first overnight run to confirm the timers fire. If you hand the skill file to your agent, it does the configuration steps and you do the clicks that macOS insists a human make.
Can my IT person or an agent do this remotely?
Most of it. The power settings, the boot chain, the security configuration, and the health check can all be done over a remote session or by an agent. A few macOS automation permissions must be approved by a person physically at the machine. Plan for one short visit to the keyboard.
What should the first job on the Agent Mac be?
A morning status sweep that lands in your inbox or Telegram at the same time every day. It is low risk, it proves the timers and the delivery path work, and you will notice immediately if it does not arrive. Once that has run for a week without you touching it, add the next operation.