Device Identity

The Companion Agent gives each endpoint a hardware-backed device identity: a non-exportable key pair generated inside the platform's secure hardware. This identity is what binds an access decision to a specific, trusted machine.

Hardware backing

Platform	Backing	Notes
Windows	TPM 2.0	Keys created via the Platform Crypto Provider; optional DPAPI wrapping.
macOS	Secure Enclave	Keys created in the Enclave; access gated by the Keychain.
Linux	TPM 2.0	Keys created via the TPM 2.0 stack; PKCS#11 fallback where present.

In all cases the private key never leaves the hardware. The Agent can request signatures and attestations but cannot read or export the key material.

Non-exportable by construction

Because the device key lives in the TPM or Secure Enclave, copying the Agent's files to another machine does not transfer the device identity. Trust is bound to the hardware.

Enrollment

On first run, the Agent generates a device key in the TPM / Secure Enclave.
It produces an attestation (where the platform supports it) proving the key resides in genuine hardware.
It registers the public key and attestation with the policy plane, associated with the enrolled user and device record.

bash

# Inspect the device identity exposed locally (loopback only)curl http://127.0.0.1:7843/v1/device/identity \  -H "Origin: https://viewer.osdfsystems.com"

json

{  "thumbprint": "tpm:9c2e…",  "backing": "tpm-2.0",  "attested": true,  "enrolled": "2026-01-18T14:02:00Z"}

Device binding

Every session assertion and policy lease carries the device thumbprint. During evaluation the Agent verifies that:

the requesting context matches the enrolled device key, and
the key still resides in hardware and is usable, and
the device record has not been revoked.

If any check fails, the decision fails closed. This is what makes a stolen password or copied token insufficient on its own - the request must originate from the bound device.

Posture signals

The device identity is paired with a compact posture summary (managed state, disk encryption, EDR health). Posture is advisory input to policy: a degraded posture can downgrade a decision from ALLOW to WARN or DENY per your rules.

Continue to smart cards for CAC/PIV credential workflows.