Device provisioning and identity
Every device gets a unique identity before it ships: certificates or keys provisioned at manufacture, a claiming flow that ties hardware to an owner, and a register that tracks state from first boot through to decommissioning.