Device identity architecture

Each device generates its private key locally and submits only a certificate signing request through a one-time enrollment token. The control plane issues a tenant-scoped certificate. The private key does not enter the control plane, install command, audit log or evidence export.

On device APIs, Meshanics derives the device and tenant from the verified client certificate. A request body cannot select another tenant or device identity. Target delivery then checks that certificate-derived tenant against the signed logical target path and expected digest.

What identity does and does not prove

The certificate proves possession of the enrolled software-held key. Software-key device-signed receipts and integrity observations therefore carry device-reported assurance. They are not proof of measured boot, hardware key protection or a clean runtime. Those stronger claims require a separately appraised hardware attestation provider and are not implied by device identity.

See PKI and CA strategy, Devices and lifecycle, and Installed artifact integrity.