Eleven signals. Weights you set. A fix for each failure.

The broker accepts agent posture reports only when their switch is on; until then no signal below reaches an access decision.

Signal	Label when it fails	Where it applies
Disk encryption	disk_unencrypted	Linux, Windows, macOS
Host firewall	firewall_off	Windows, macOS; Linux reads ufw, firewalld or the kernel's own firewall rules
Screen lock	screenlock_off	Windows, macOS; Linux reads GNOME only, other desktops read as off
OS security updates	patch_outdated	Windows, macOS; Linux reads apt only, otherwise not reported
Antivirus or EDR	edr_absent	Windows via Security Center; Linux, macOS from known agents; left out when undetermined
Secure Boot	secure_boot_off	Linux, Windows; macOS on Apple Silicon only, Intel Macs read as off
TPM or Secure Enclave	no_tpm	Linux, Windows; macOS on Apple Silicon only, Intel Macs read as absent
Automatic updates	auto_update_off	Windows, macOS; Linux reads the apt upgrade timer only, otherwise off
Central management	unmanaged	Windows, macOS; Linux reads only a realm join and never reports unmanaged
System Integrity Protection	sip_off	macOS only; not applicable elsewhere, at no cost
Gatekeeper	gatekeeper_off	macOS only; not applicable elsewhere, at no cost

Weights are defaults; administrators can retune every one; a disabled check costs nothing. Besides the signal labels, the seventeen include the score-only os_outdated label, for a device below an administrator's minimum OS version (it never drops the tier); and cve_critical, cve_high and cve_medium, from published vulnerability advisories matched to the packages the agent reports. The table shows the weights an unconfigured deployment scores with.

Label	Default weight
cve_critical	30
impossible_travel	25
cve_high	20
disk_unencrypted	20
edr_absent	15
firewall_off	15
new_device	15
os_outdated	15
patch_outdated	12
screenlock_off	12
unmanaged	12
auto_update_off	10
cve_medium	10
sip_off	10
gatekeeper_off	8
no_tpm	8
secure_boot_off	8

The coach is deterministic, no model: fixed text and platform steps per failing check, its cost from the administrator's weights, and unknown for an unreported signal. It covers the eleven signals and os_outdated.

What this does not show: a real device's report, tuned or disabled checks, or how the broker sets the tier; fixes are the coach's macOS steps, shown only where it has them.

Text version

1. disk_unencrypted: Turn on FileVault: System Settings → Privacy & Security → FileVault → Turn On.
2. screenlock_off: System Settings → Lock Screen → require a password after the screen starts, and turn on Hot Corners / short delay.
3. firewall_off: System Settings → Network → Firewall → turn On.
4. patch_outdated: System Settings → General → Software Update → install all available updates.
5. edr_absent: Install and enable your organisation's endpoint protection / antivirus agent.
6. auto_update_off: System Settings → General → Software Update → Automatic updates → turn everything on.
7. secure_boot_off
8. no_tpm
9. unmanaged: Enrol in your organisation's MDM: install the management profile from IT (System Settings → General → Device Management).
10. sip_off: Re-enable System Integrity Protection: reboot into Recovery (Apple Silicon: hold the power button; Intel: hold ⌘R), open Terminal, run `csrutil enable`, then restart.
11. gatekeeper_off: Re-enable Gatekeeper: run `sudo spctl --master-enable`, or System Settings → Privacy & Security → set "Allow applications from" to App Store & identified developers.

Score starts at 100 / 60 / 30 by tier and loses each failing check's weight once; a rule may require a minimum.