{"version":"2.1.318","anchor":"device-attestation-policy-enforcement-and-unsent-call-guard","canonical_anchor":"device-attestation-policy-enforcement-and-unsent-call-guard","heading":"Groundwork for refusing unverified devices in remote sessions","tier":"soon","area":"Device Policy","scope":"org","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.318\/e\/device-attestation-policy-enforcement-and-unsent-call-guard","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.318","markdown":"### Groundwork for refusing unverified devices in remote sessions\n\nThe remote session client can now tell whether a device-verification policy is being enforced, and has a hook for explaining why a call was not sent\n\n**What**\n\nDevice attestation is a check that proves a device is the one it claims to be. The part of Claude Code that handles remote session clients gained a check that reports whether a device policy is being enforced. It counts as enforced only when the policy is set to enforce and every status it accepts is one Claude Code recognises.\n\nOther changes in the same place:\n\n- A hook that can give a reason for not sending a call. It returns nothing for now, and sending a served call request now passes through it.\n\n- A counter once named for dropped answers now counts session refusals.\n\n- A one-time warning when the parts that write to the session are missing.\n\n**Why**\n\nThis lays groundwork for refusing devices that cannot prove who they are in remote sessions. Nothing is refused through the new hook yet.\n\n- Area: Device Policy\n- Tier: Nothing to try yet\n- Useful: 3\/5\n- Signal: 4\/5\n- Scope: org\n- Heads-up: no\n- Present in the build but not switched on"}