The companion

Deploying Goose with device management

Install the Mac app across your company with Jamf Pro, Kandji or Microsoft Intune, pre-allow its notifications and login item, and manage its updates.

This page is for IT teams installing the Goose Mac app on company Macs through a device management (MDM) service. It covers the installer package, a sample configuration profile, the settings you can manage, and the two permissions each person still approves themselves.

What you need

Macs on macOS 14.4 or later, with Apple silicon.
An MDM service. The steps below name Jamf Pro, Kandji and Microsoft Intune; any MDM that can deploy a package and a custom configuration profile works the same way.
The installer package: getgoose.ai/companion/download/pkg. It always downloads the current version.
The sample profile: goose-device-management.mobileconfig.

The installer package

The package installs Goose into /Applications without asking the user anything. It is signed with Goose's Developer ID Installer certificate and notarized by Apple, so macOS opens it without a warning.

Jamf Pro: upload it as a package, then add it to a policy scoped to your computers.
Kandji: add a Custom App to the Library and upload the package.
Microsoft Intune: add an app of type macOS app (PKG) under Apps › macOS, and assign it to your devices.

To install it by hand, or from a script:

sudo installer -pkg GooseCompanion-latest.pkg -target /

The configuration profile

The sample profile has three parts. Change the settings to suit your company, then upload it as a custom profile and deliver it to the computer, not to the user:

Jamf Pro: Computers › Configuration Profiles › Upload.
Kandji: Library › Custom Profile.
Microsoft Intune: Devices › Configuration › Create › macOS › Templates › Custom, with the deployment channel set to Device channel.

Deliver it through your MDM. Opening the file on a Mac does not apply it: macOS accepts the login item part only from an MDM the Mac is enrolled in.

Notifications

Goose uses notifications to say when a meeting's notes are ready, when a recording couldn't be sent, and, before a meeting, when something would stop or limit its recording. The profile turns them on with the persistent banner style (macOS used to call it Alerts), so they stay on screen until dismissed, and shows them in Notification Center and on the Lock Screen.

Goose opens when the user logs in, so it is ready for the first meeting of the day. The profile marks Goose as a managed login item, so it stays on and users can't switch it off in System Settings › General › Login Items. The rule matches Goose's bundle identifier, ai.getgoose.companion, limited to Goose's Apple team ID, 9FQUV2M73L.

Goose settings

These are managed preferences for the ai.getgoose.companion domain. Each is a boolean, and Goose reads it only when your profile sets it, so users can't change it themselves.

Setting	What it does
`SkipMoveToApplications`	Goose never asks the user to move it into the Applications folder. The sample sets it to `true`, because the package already installs there.
`DisableAutoUpdates`	Turns off Goose's own updater. Check for updates is replaced by "Updates are managed by your organization", and Goose never downloads or installs a new version itself. You deploy each new package instead. The sample sets it to `false`.

Any profile for the ai.getgoose.companion domain also tells Goose it was installed by IT, so it never asks to be moved, even without SkipMoveToApplications.

Updates

With DisableAutoUpdates off, Goose checks for new versions itself and installs them when the user quits it. An update never interrupts a recording.

The package installs Goose as an administrator, so a user who isn't an administrator on their Mac can't replace it: when Goose offers an update, macOS asks for an administrator's name and password. If your users aren't administrators, set DisableAutoUpdates to true and deploy each new version through your MDM. The download link above always gives you the current version, and the Mac app changelog lists what each one changes.

What each person approves

Two permissions can't be granted by a profile, so each person approves them once, the first time Goose asks:

Microphone, to record their side of the call. Apple doesn't let a configuration profile turn the microphone on for an app; a profile can only block it.
System Audio Recording, to record the other people on the call from the sound their Mac plays. macOS has no configuration profile setting for this permission.

Goose asks for both during its setup, and again ahead of a meeting if either is still off. Goose doesn't use Screen Recording, so the profile doesn't include a privacy (PPPC) setting for it. What the companion asks permission for describes each permission as your users see it.

Check it worked

On a Mac that has both the package and the profile:

Goose is in /Applications and opens at login.
System Settings › Notifications › Goose shows notifications on, with the persistent banner style.
In Goose's Settings, under Software Update, the line under the version reads "Updates are managed by your organization" if you set DisableAutoUpdates to true.
In Terminal, defaults read "/Library/Managed Preferences/ai.getgoose.companion" prints the settings your profile set.