Design Device Trust - System Design | WinJob

Problem Statement: Device Trust Beyond User Login

Design a device trust platform for User → MDM Agent → Posture Gateway → IdP → ZTNA → App where Microsoft Conditional Access, Duo, and Zscaler patterns converge on continuous endpoint evidence—not one-time login trust.

Design anchors (1)

Device trust scores endpoints independently from user MFA—stolen passwords on compromised laptops still fail policy.
Posture claims are signed, versioned, and time-bounded; stale telemetry cannot silently inherit yesterday's trust.
Conditional access binds OAuth tokens to device_id + key continuity (DPoP/mTLS) to block bearer replay on another host.

Mechanism

Enrollment mints a device identity (SPIFFE-style URI or X.509 cert). Agents stream posture deltas to a normalization service that emits canonical risk primitives (patch_age, encryption, edr_health, jailbreak). The trust engine fuses posture + UEBA + geo velocity into a tier: trusted, elevated, restricted, quarantined.

Failure drills

If posture bus lags beyond SLA, payroll APIs step-up while read-only SaaS degrades gracefully. If MDM agent is tampered, kernel-protected sensors and TPM quotes fail attestation. If revocation fan-out stalls, IdP session kill switches expire refresh tokens within 30 seconds.

Cost and capacity

At 95K posture updates/sec peak, budget 12ms trust evaluation p99 and 220 GB/day immutable decision logs.

Signal	Target
250K	devices
18ms	p99
4h	posture TTL
100%	deny unknown

javaOne Dark Pro

1 public record DeviceTrustVerdict(String deviceId, int trustTier, Instant postureAsOf, boolean stepUp) {
2   public boolean allowProductionWrite() { return trustTier <= 1 && !stepUp; }
3 }

pythonOne Dark Pro

1 def posture_is_stale(observed_at: float, now: float, ttl_sec: int) -> bool:
2     return (now - observed_at) > ttl_sec

typescriptOne Dark Pro

1 export type TrustTier = 0 | 1 | 2 | 3;
2 export function needsStepUp(tier: TrustTier, action: string): boolean {
3   return tier >= 2 || (tier === 1 && action === "export_keys");
4 }

Interview note (sec-001)

When presenting Problem Statement: Device Trust Beyond User Login, tie claims to observable signals—interviewers at Duo/Microsoft expect you to separate user authN from device assurance.

Why interviewers care

Device Trust interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

Interview checkpoint

Name one failure story for Problem Statement: Device Trust Beyond User Login that proves you understand real outages, not happy-path diagrams.

Key Highlights

•Problem Statement: Device Trust Beyond User Login
•Metrics: 250K devices, 18ms p99, 4h posture TTL, 100% deny unknown
•Device trust

1	public record DeviceTrustVerdict(String deviceId, int trustTier, Instant postureAsOf, boolean stepUp) {
2	public boolean allowProductionWrite() { return trustTier <= 1 && !stepUp; }
3	}

1	def posture_is_stale(observed_at: float, now: float, ttl_sec: int) -> bool:
2	return (now - observed_at) > ttl_sec

1	export type TrustTier = 0 \| 1 \| 2 \| 3;
2	export function needsStepUp(tier: TrustTier, action: string): boolean {
3	return tier >= 2 \|\| (tier === 1 && action === "export_keys");
4	}