Device Trust · 4 min read
Approving a new device for a field agent
A field agent cannot authenticate from just any phone. Device trust requires that a device be enrolled and then approved by an administrator before it becomes a trusted device able to sign in — so a lost, borrowed, or unknown handset is not a way into the system.
Why device approval exists
Field agents collect cash and record repayments on mobile devices, often offline. Tying an agent's account to specific approved devices means that even if a password leaks, an attacker cannot simply log in from their own phone — the device itself must first have been enrolled and approved.
The approval step
- 1Agent submits an enrolment requestFrom the mobile app, the agent's new device raises an enrolment request — this is the field-side flow.
- 2Administrator reviews and approvesYou confirm the device belongs to the agent it claims to, then approve the enrolment. Only on approval does the device become trusted.
- 3Device becomes trusted and can authenticateOnce approved, the device is a trusted device and the agent can sign in and work from it.
Approve deliberately
Approval is the control point. Approve a device only when you can confirm whose it is; an unrecognized enrolment request should be questioned, not rubber-stamped.