Enterprise IT support is constrained by heterogeneous devices, evolving policies, and long-tail failure modes that are difficult to resolve centrally. We present VIGIL, an edge-extended agentic AI system that deploys desktop-resident agents to perform situated diagnosis, retrieval over enterprise knowledge, and policy-governed remediation directly on user devices with explicit consent and end-to-end observability. In a 10-week pilot of VIGIL's operational loop on 100 resource-constrained endpoints, VIGIL reduces interaction rounds by 39%, achieves at least 4 times faster diagnosis, and supports self-service resolution in 82% of matched cases. Users report excellent usability, high trust, and low cognitive workload across four validated instruments, with qualitative feedback highlighting transparency as critical for trust. Notably, users rated the system higher when no historical matches were available, suggesting on-device diagnosis provides value independent of knowledge base coverage. This pilot establishes safety and observability foundations for fleet-wide continuous improvement.
Figures & tables
Figure 1: Operational and self-improvement loops within VIGIL. Device-level cognition, the focus of this paper, executes locally on endpoints (shown in blue ), while cloud-level reflection, designed for future activation, refines policies, memory, and prompts over time (shown in red ). Monitoring at the fleet level operates in parallel across both loops (shown in black ).
Figure 2: VIGIL’s agentic architecture integrating local edge agents and remote cloud agents. Edge agents execute diagnosis and remediation on-device, while cloud agents provide coordination, governance, and observability across the fleet.
Tool
Purpose
system_uptime
Retrieves device uptime to identify reboots
security_updates
Detects pending enterprise security updates
cpu_process
Retrieves top running processes by CPU usage
disk_usage
Reports disk usage across all mount points.
network_status
Retrieves network connectivity status
Table 1: Illustrative diagnostic tools used in the diagnose–retrieve–remediate loop.
Metric
SHIELD
Human Support
Interaction rounds (median)
11 cycles
18 turns ∗
Diagnosis time (median)
36.5 s
≥ 2.7 min †
Response quality (median)
8.0 / 10
—
Self-service potential
82% (high + medium confidence)
Table 2: Operational metrics on matched cases (n=60). ∗ Human support rounds reflect full conversational turns between user and support engineer. Interaction rounds were reduced by 39% (83% of cases). † Conservative lower bound assuming 10% of median contact duration (26.5 min) reflects active work; realistic estimates yield 4–17 × speedup.
Figure 3: User experience survey: (a) SUS score distribution, (b) NASA-TLX workload, (c) user trust (bottom-left) and (d) technology acceptance
Instrument
Score
SUS
86.2 ± 15.7
Trust in Automation
4.29 / 5.0
TAM
4.41 / 5.0
NASA-TLX
2.53 / 7.0
Table 3: User experience scores across four validated instruments (n=23). SUS industry average is 68.0.
Figure 4: Normalized summary of the user experience survey across the four validated instruments (n=23)
Layer
Technology
Agent Framework
AWS Strands (Python)
LLM Inference
Claude Opus 4.1
Inter-Agent Protocol
Agent2Agent (A2A)
Packaging
PyInstaller
Observability
OpenTelemetry tracing
Table 4: Core implementation components of VIGIL
Figure 5: Item-level SUS score breakdown (1–5 scale). Positive-framed items (higher is better) and negative-framed items (lower is better) are shown separately. The dashed line indicates the neutral midpoint (3.0).