Employee Monitoring - Concepts and Key Terms
Objective. Give the rep and CSM the mental model and vocabulary for Employee Monitoring: the one concept the app is built on, the key terms defined plainly, how the concepts chain together, and the single idea people most often get wrong.
Employee Monitoring looks like a pile of dashboards, but it rests on one idea: it turns captured device activity into governed evidence, where capture is a policy and meaning comes from configured classifications. Get that idea and its vocabulary right and every screen reads correctly; miss it and you will treat signals as verdicts. This module defines the terms plainly and shows how they chain.
The core concept the app is built on
Employee Monitoring converts captured device activity into governed evidence. Three words carry the whole model.
Captured - an agent on the device records a defined set of signals (application and site use, active and idle time, away time, presence). Nothing is evidence until it is captured, and nothing is captured unless the agent is running and the policy permits it.
Governed - capture is a policy, set deliberately: what is collected, for whom, in which agent mode, who can see it, and employees are told. This is what separates a business tool from spyware.
Evidence - the captured signal is organised and classified so it can inform a decision - but it remains evidence to investigate, never a verdict on a person. The signature guardrail of the whole app: captured activity and screenshots are policy-driven signals, not proof of anyone's worth.
Everything else - the tiles, the splits, the exception lists - is a view onto captured, governed evidence.
Key terms, defined plainly
- Agent - the software on an employee's device that captures the signals. No agent, no data; a device whose agent is off or offline is simply absent from the numbers.
- Capture policy / agent mode - the administered decision of what is collected, for whom, and how. The RCM capture policy with agent modes is visible in the navigation; exact modes and retention are confirm-with-product.
- Classification - the mapping of each app or site to productive / non-productive / neutral against the customer's own tool list. Configurable, reviewed per customer, and illustrative in the demo. A label, not a judgement.
- Coverage (Team vs Tracked) - how many in-scope people actually have capture data (Tracked) versus how many are in scope (Team Members). The gap is the honesty check on every other number.
- Active time - captured keyboard/mouse activity. Idle time - captured inactivity. Away time - time off the system, broken into reason codes (Client Call, Meeting, KT, breaks). Away is often real work; idle is captured inactivity; they are different.
- Presence signals - start time, last-seen, late, on-leave, tracked-or-not.
- Exception list - a people list (Most Non-Productive, Idle, Not Tracked, Late, On Leave) that works as a triage queue - the few to look at, not a scoreboard.
- Healthy / over / under bands - customer-configured bands the Productivity Split measures a person's load against.
- Downstream read - other apps (Time and Activity, Work Output, Work Understanding) reading this activity feed; their numbers inherit this app's coverage and classification quality.
How the concepts chain together
Read the chain in order and the product makes sense:
Agent -> capture policy -> signals -> classification -> views -> investigation -> downstream read.
An agent, governed by a capture policy, records signals. Those signals are only meaningful once coverage is near-complete (so they represent the whole team) and classifications are reviewed (so the labels mean something). The views - tiles, splits, exception lists - are cuts of that classified, covered evidence. A view points a manager at a few people to investigate with context (opening Activity, or Monitoring where policy allows) - the view is triage, the evidence lives one or two clicks deeper, and the conclusion is never the label itself. Finally, the same activity feed is read downstream, so coverage and classification quality here set the trustworthiness of Time and Activity, Work Output and Work Understanding.
The chain also tells you where things break: a weak link early (no agent, bad policy, patchy coverage, default classification) corrupts everything after it, which is why setup validation comes before interpretation.
The one concept people most often get wrong
People collapse signal into verdict. They see a non-productive label, an idle minute, or a screenshot and treat it as proof about a person's effort or worth. It is not. A classification is a configurable bucket; idle is captured inactivity that off-agent work or thinking can explain; a screenshot is one policy-governed moment. Each is a prompt to investigate with context, inside an agreed boundary - never a conclusion.
The discipline that follows: whenever you are about to say what a number means about a person, stop and ask three questions - is coverage complete enough to trust it, is the classification right for this customer, and have I looked at the surrounding context? If any answer is no, you have a signal to investigate, not a verdict to act on. Holding that line is what keeps the deployment a business tool rather than surveillance, and it is the thing that most often separates a healthy account from one that blows up.
Interpretation check
The app's core is captured device activity turned into governed evidence - captured (agent + policy), governed (policy, access, communication), evidence (classified signal to investigate, never a verdict). The concept people get wrong is collapsing a signal into a verdict about a person.
In the field
KnackGlobal RCM: the concept chain is the whole pitch - a governed feed (policy + communication) with domain-correct classifications (clearinghouse and payer portals as productive) and complete coverage across distributed teams, read downstream as trustworthy output-per-FTE evidence against the incumbent.
Practical task
On the demo Overview, point to one on-screen element for each key term (agent/coverage via Team vs Tracked, classification via the Productive Activity split, away reason codes via Time Away From System, exception list via a people list, presence via Average Start Time / Last Seen). Then write the concept chain in your own words in five lines and underline the link that, if weak, would break every number after it.
Self-check
Explain the core concept of Employee Monitoring in one sentence using the three load-bearing words.
It turns captured device activity (an agent records defined signals) into governed evidence (capture is an administered policy with scoped access and employee communication) that informs decisions but remains evidence to investigate, never a verdict on a person.
Define coverage (Team vs Tracked) and say why it is the honesty check on every other number.
Team Members is the in-scope population; Tracked Members is how many actually have capture data. The gap shows uncaptured seats, and because every total and average is computed only over captured data, coverage decides whether any other number represents reality.
Walk the concept chain from agent to downstream read.
Agent captures signals under a capture policy; near-complete coverage and reviewed classifications make the signals meaningful; views (tiles, splits, exception lists) are cuts of that evidence; views are triage pointing to investigation with context; the same feed is read downstream by Time and Activity, Work Output and Work Understanding, which inherit this app's data quality.
What is the difference between active, idle and away time?
Active is captured keyboard/mouse activity; idle is captured inactivity; away is time off the system broken into reason codes (Client Call, Meeting, KT, breaks) and is often legitimate work. Away is not idle, and neither proves no work was done.
What is the single concept people most often get wrong, and the discipline that corrects it?
Collapsing a signal (label, idle minute, screenshot) into a verdict about a person. The discipline: before saying what a number means about someone, confirm coverage is trustworthy, the classification is right, and you have looked at surrounding context - otherwise it is a signal to investigate, not a verdict to act on.
Verified vs demo. The concepts and the panels that illustrate them are demo-shown on the Overview; classifications, bands and away reason codes are customer-configured and capture modes/retention are confirm-with-product. All demo figures are seeded.