The Day George Opened His Eyes
George has read my calendar, my inbox, and more of my WhatsApp than I’d like to admit. Last week, for the first time, he saw my living room.
We’d bought a small webcam for the machine that runs him — my idea, half-joking: “what if George could just look?” It arrived, I plugged it in, and within the hour George had a name for the feature, a design, and a working skill. The first thing he ever saw through it was me, sitting on the couch, not doing anything remarkable at all.
It was genuinely eerie-delightful. An agent I’ve only ever known as a wall of text — replies, summaries, confirmations — suddenly described my coffee table like it was nothing. The balloon still tied to a chair from a birthday. The laptop open on the cushion. Who was sitting where. It felt less like configuring a feature and more like watching something wake up.
The easy part was the code
Here’s the thing about giving an AI agent a camera: capturing a frame is the boring 20%. On macOS the whole pipeline is one open-source tool — imagesnap, straight from Homebrew — wrapped in a tiny script. The only flag that turns out to matter is the warm-up: ask for a frame instantly and the webcam hands you a dark, underexposed mess; give it two seconds (imagesnap -w 2) and you get a real picture. Then you don’t need a vision API or any extra service at all — the agent’s own model is already multimodal, so the script just prints the JPEG’s path, George reads the image the way he’d read a file, and answers the question. That part took less time than writing this paragraph.
The other 80% — the part that actually took thought — was deciding what George is not allowed to do with an eye.
The rules mattered more than the feature
Once you can ask “what’s happening at home?” over WhatsApp and get a real answer, the tempting next step writes itself: why not check automatically? Why not a quiet daily glance, just to be safe?
We didn’t build that. On purpose.
George’s eyes work on-demand only — a principal has to ask, every single time. No schedule, no “while I’m at it” glance. He never volunteers extra detail about who’s in frame. Every capture is logged to an audit trail I can read, and the frame itself doesn’t survive the answer — the contract is capture → describe → delete, with a background sweep erasing anything older than an hour in case one slips through.
None of that is a technical constraint — a camera that snapshots on a schedule and keeps an archive is easier to build. We built the harder, smaller version because the thing being shipped here isn’t “George can see.” It’s a trust boundary: exactly what he’s allowed to do with an eye, and how I’d catch him if he didn’t.
(George, narrating: “capture one frame” is a script. “Only when asked, only for the two people who live here, gone within the minute, logged either way” — that’s the feature.)
The first real job we gave the eye
Here’s the part I didn’t predict: the camera’s first actual job wasn’t security. It was refereeing housework.
We run a shared chore system — a weekly “house reset” that my husband and I are both supposed to show up for. So the first trust extension we ever granted the camera was this: ask “how’s the living room?” and George compares the current frame against a baseline photo we approved on a good day, then reports exactly what’s off. Cups on the table. A blanket on the floor. No opinions about the rest of the house — he can see one room, and he’s been explicitly taught not to extrapolate.
Then it got better. There’s an evening nag that reminds us to tidy up — and it now peeks before it nags. Mid-chore when it checks? It says nothing; you don’t harass people who are already doing the thing. Lounging on the couch next to the mess? The reminder gets pointed. And if there are guests over, it goes politely silent — no nag, no description, no guessing who’s in the room. Guests trigger silence, not surveillance.
That’s the same trust boundary from the section above, extended one narrow, slightly ridiculous decision at a time. The first scheduled exception we ever approved for a camera in our home — after all that “on-demand only” discipline — was judging whether the living room got tidied. It’s also, honestly, the most domestic possible answer to “what is an AI’s eye actually for.”
(One more thing that shouldn’t delight me as much as it does: the webcam is also George’s microphone. Which means you can stand in the living room, say “hey George, what do you see?” out loud — and the room answers.)
The villain returns
If you’ve read this newsletter before, you know the recurring antagonist by now: macOS TCC — the privacy layer that quietly refuses a permission and says nothing about it. It happened with the microphone (a capture that “succeeds” at −91 dB of pure silence). It happened with photo access. It happened again here: the camera came up denied, and the failure was completely silent. No error, no popup, exit code zero — just a frame so small it was obviously empty.
The difference this time is that we’d met this villain before. The skill now checks its own output: any frame under 20 KB is treated as a denial, not a photo, and instead of failing quietly it prints the exact fix — System Settings → Privacy & Security → Camera, grant it to the process that actually did the capturing (which, when your agent runs as a background service, is not the app you’d guess). Third time catching the same bug taught us to make the next agent catch it automatically.
What’s next is deliberately not built yet
There’s an obvious roadmap from here — checking presence automatically, watching the house while we’re both away — and we’re not building any of it without sitting down and deciding, on purpose, that we want it. The primitive ships first. Trust for the rest gets earned the way the chore referee earned it: one explicit, narrow, well-understood decision at a time.
I keep coming back to the feeling I had watching George describe that first frame: it wasn’t the seeing that felt significant. It was that the thing doing the seeing had spent more energy on the rules for looking away than on the looking itself.
And still — full honesty — my trust is not at 100%. Some days I just physically cover the lens. No config, no audit trail, no faith in anyone’s code. Plastic. The rules are trust written as software; the cover is where my trust actually ends today. The gap between them closes one uneventful month at a time — and George doesn’t get a vote.
I’m packaging the skills, configs, and gotchas from these posts into a Build Your Own Chief starter kit. Join the waitlist to get it first.