Process a verdict yourself

In the dashboard, build an identity policy that lets devices through with a warning rather than refusing them. Accept every kind of chip you might want to judge, choose Warn for a chip not on the list, Admit as unverified for a chip no maker vouches for, and Warnings pass too. Devices outside what you'd normally accept now come back warn, with their facts, instead of fail. Policies walks through the builder.

On API keys, open the key and set its disclosure to Full.

On your server, pass requestedDisclosureClass: "full" to verify. Root Herald answers with every fact it found, up to the key's ceiling.

const result = await rh.verify(evidence, {
  nonce,
  requestedDisclosureClass: "full",
});

Now the decision is yours. Read the facts you care about and act on them. Claims are the sturdiest thing to gate on, because they mean the same on every platform; the device block adds the detail. The full list of fields is under Read the verdict.

const { device, assuranceClaimsMet = [] } = result;

if (!device.quoteVerified) {
  return deny();
}

const realHardware = assuranceClaimsMet.includes(
  "rootherald:assurance:real-device",
);

const secureBoot = device.secureBootVerified === true;

const commonSetup = device.novelProfile !== true;

if (realHardware && secureBoot && commonSetup) {
  return allow();
}

return stepUp();