---
title: "Get transactions"
method: GET
path: "/transactions"
tags: ["Transactions"]
---

# Get transactions

`GET /transactions`

## Request

- Base URL: `https://api.xfa.tech`
- URL: `https://api.xfa.tech/transactions`
- Auth: HTTP bearer

## Query parameters

- `organizationId` string, required

## Response `200`

Returns all transactions

- ListTransactions
  - `devices` Transactions[]
    - `application` Application
      - `organizationID` string, required: ID of the organization
      - `applicationID` string, required: ID of the application
      - `policyID` string: ID of the policy
      - `type` 'MicrosoftEAM' | 'Okta' | 'Onelogin' | 'Google' | 'Microsoft' | 'OktaDiscovery' | 'IdP': Type of the application
      - `testKey` string: Test key
      - `name` string, required: Name of the application
      - `iconUrl` string: Icon URL of the application
      - `policies` Policies: Shared policy representation. On PUT, each OS-specific override (`windows_os`, `macos_os`, `linux_os`, `android_os`, `ios_os`, and `ipados_os`) uses presence-aware update semantics: an omitted key preserves the stored override, `null` removes it and resumes inheritance from `os`, `{}` stores an explicitly disabled override without falling back, and a non-empty object replaces it with a custom version policy. These rules apply both to the policy PUT request body and to the same policy object when it is nested under `Application.Policies` in an application PUT request. For example, use `{"Policies":{"windows_os":null}}` to clear an inline Windows override.
        - `policy_id` string, required: Unique identifier for the policy
        - `organization_id` string, required: Organization identifier
        - `created_by_email` string: Email of the user who created the policy
        - `created_at_epoch_seconds` integer: Unix epoch seconds when the policy was created
        - `updated_by_email` string: Email of the user who last updated the policy
        - `updated_at_epoch_seconds` integer: Unix epoch seconds when the policy was last updated
        - `name` string, required: Policy name
        - `installed` boolean: Require the native application to be installed
        - `unsupported` boolean: Skip unsupported devices automatically
        - `skip` boolean: Allow users to skip the token flow
        - `skip_limit` SkipLimit
          - `max_skips` integer, required
        - `skip_mobile` boolean: Allow users to skip the token flow on mobile
        - `skip_desktop` boolean: Allow users to skip the token flow on desktop
        - `agentless_allowed` boolean: Allow agentless providing of posture
        - `os` VersionPolicy
          - `WarnTime` integer: Warn users if their version is older than this many seconds
          - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
          - `BlockTime` integer: Block users if their version is older than this many seconds
          - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
          - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates
          - `older_supported_major_versions` MajorVersionsPolicy
            - `dont_warn` boolean, required: Do not warn users if on older, but supported major version
            - `dont_block` boolean, required: Do not block users if on older, but supported major version
          - `beta_versions` BetaVersionsPolicy
            - `dont_warn` boolean, required: Do not warn users if on beta version
            - `dont_block` boolean, required: Do not block users if on beta version
        - `windows_os` VersionPolicy
          - `WarnTime` integer: Warn users if their version is older than this many seconds
          - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
          - `BlockTime` integer: Block users if their version is older than this many seconds
          - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
          - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates
          - `older_supported_major_versions` MajorVersionsPolicy
            - `dont_warn` boolean, required: Do not warn users if on older, but supported major version
            - `dont_block` boolean, required: Do not block users if on older, but supported major version
          - `beta_versions` BetaVersionsPolicy
            - `dont_warn` boolean, required: Do not warn users if on beta version
            - `dont_block` boolean, required: Do not block users if on beta version
        - `macos_os` VersionPolicy
          - `WarnTime` integer: Warn users if their version is older than this many seconds
          - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
          - `BlockTime` integer: Block users if their version is older than this many seconds
          - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
          - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates
          - `older_supported_major_versions` MajorVersionsPolicy
            - `dont_warn` boolean, required: Do not warn users if on older, but supported major version
            - `dont_block` boolean, required: Do not block users if on older, but supported major version
          - `beta_versions` BetaVersionsPolicy
            - `dont_warn` boolean, required: Do not warn users if on beta version
            - `dont_block` boolean, required: Do not block users if on beta version
        - `linux_os` VersionPolicy
          - `WarnTime` integer: Warn users if their version is older than this many seconds
          - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
          - `BlockTime` integer: Block users if their version is older than this many seconds
          - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
          - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates
          - `older_supported_major_versions` MajorVersionsPolicy
            - `dont_warn` boolean, required: Do not warn users if on older, but supported major version
            - `dont_block` boolean, required: Do not block users if on older, but supported major version
          - `beta_versions` BetaVersionsPolicy
            - `dont_warn` boolean, required: Do not warn users if on beta version
            - `dont_block` boolean, required: Do not block users if on beta version
        - `android_os` VersionPolicy
          - `WarnTime` integer: Warn users if their version is older than this many seconds
          - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
          - `BlockTime` integer: Block users if their version is older than this many seconds
          - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
          - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates
          - `older_supported_major_versions` MajorVersionsPolicy
            - `dont_warn` boolean, required: Do not warn users if on older, but supported major version
            - `dont_block` boolean, required: Do not block users if on older, but supported major version
          - `beta_versions` BetaVersionsPolicy
            - `dont_warn` boolean, required: Do not warn users if on beta version
            - `dont_block` boolean, required: Do not block users if on beta version
        - `ios_os` VersionPolicy
          - `WarnTime` integer: Warn users if their version is older than this many seconds
          - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
          - `BlockTime` integer: Block users if their version is older than this many seconds
          - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
          - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates
          - `older_supported_major_versions` MajorVersionsPolicy
            - `dont_warn` boolean, required: Do not warn users if on older, but supported major version
            - `dont_block` boolean, required: Do not block users if on older, but supported major version
          - `beta_versions` BetaVersionsPolicy
            - `dont_warn` boolean, required: Do not warn users if on beta version
            - `dont_block` boolean, required: Do not block users if on beta version
        - `ipados_os` VersionPolicy
          - `WarnTime` integer: Warn users if their version is older than this many seconds
          - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
          - `BlockTime` integer: Block users if their version is older than this many seconds
          - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
          - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates
          - `older_supported_major_versions` MajorVersionsPolicy
            - `dont_warn` boolean, required: Do not warn users if on older, but supported major version
            - `dont_block` boolean, required: Do not block users if on older, but supported major version
          - `beta_versions` BetaVersionsPolicy
            - `dont_warn` boolean, required: Do not warn users if on beta version
            - `dont_block` boolean, required: Do not block users if on beta version
        - `os_autoupdate` object
          - `warn` boolean, required: Warn users if OS auto-update is not enabled
          - `block` boolean, required: Block users if OS auto-update is not enabled
          - `goal` boolean: Goal - whether OS auto-update should be enabled
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `browser` VersionPolicy
          - `WarnTime` integer: Warn users if their version is older than this many seconds
          - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
          - `BlockTime` integer: Block users if their version is older than this many seconds
          - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
          - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates
          - `older_supported_major_versions` MajorVersionsPolicy
            - `dont_warn` boolean, required: Do not warn users if on older, but supported major version
            - `dont_block` boolean, required: Do not block users if on older, but supported major version
          - `beta_versions` BetaVersionsPolicy
            - `dont_warn` boolean, required: Do not warn users if on beta version
            - `dont_block` boolean, required: Do not block users if on beta version
        - `pdf_readers` VersionPolicy
          - `WarnTime` integer: Warn users if their version is older than this many seconds
          - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
          - `BlockTime` integer: Block users if their version is older than this many seconds
          - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
          - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates
          - `older_supported_major_versions` MajorVersionsPolicy
            - `dont_warn` boolean, required: Do not warn users if on older, but supported major version
            - `dont_block` boolean, required: Do not block users if on older, but supported major version
          - `beta_versions` BetaVersionsPolicy
            - `dont_warn` boolean, required: Do not warn users if on beta version
            - `dont_block` boolean, required: Do not block users if on beta version
        - `disk_encryption` object
          - `warn` boolean, required: Warn users if disk is not encrypted
          - `block` boolean, required: Block users if disk is not encrypted
          - `goal` boolean: Goal - whether disk encryption should be enabled
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `screen_lock` object
          - `warn` boolean, required: Warn users if screen lock is not enabled or timeout exceeds max_timeout
          - `block` boolean, required: Block users if screen lock is not enabled or timeout exceeds max_timeout
          - `goal` boolean: Goal - whether screen lock should be enabled
          - `max_timeout` integer: Maximum allowed screen lock timeout in seconds
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `antivirus` AntivirusPolicy
          - `warn` boolean, required: Warn users if antivirus is not enabled
          - `block` boolean, required: Block users if antivirus is not enabled
          - `goal` boolean: Goal - whether antivirus should be enabled
          - `requirements` AntivirusRequirements, nullable: Missing requirements preserve stored rules on update; null clears all rules. Missing OS fields preserve their rule; null clears it.
            - `windows` AntivirusProductRequirement, nullable
              - …
            - `linux` AntivirusProductRequirement, nullable
              - …
            - `macos` AntivirusProductRequirement, nullable
              - …
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `password_manager` object
          - `warn` boolean, required: Warn users if password manager is not enabled
          - `block` boolean, required: Block users if password manager is not enabled
          - `goal` boolean: Goal - whether password manager should be enabled
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `biometrics` object
          - `warn` boolean, required: Warn users if biometric is not enabled
          - `block` boolean, required: Block users if biometric is not enabled
          - `goal` boolean: Goal - whether biometric should be enabled
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `reboot` object
          - `WarnTimeInDays` integer: Warn users if they have not reboot their device more than this many days
          - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
          - `BlockTimeInDays` integer: Block users if they have not reboot their device more than this many days
          - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
          - `GoalTimeInDays` integer: Goal - days that devices are allowed to be without rebooting
        - `windows_recall` object
          - `warn` boolean, required: Warn users if they have not disabled windows recall
          - `block` boolean, required: Block users if they have not disabled windows recall
          - `goal` boolean: Goal - whether windows recall should be disabled
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `xfa_version` VersionPolicyInDays
          - `WarnTimeInDays` integer: Warn users if their version is older than this many days
          - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
          - `BlockTimeInDays` integer: Block users if their version is older than this many days
          - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback.
          - `GoalTimeInDays` integer: Goal - days that devices are allowed to be outdated with security updates
          - `older_supported_major_versions` MajorVersionsPolicy
            - `dont_warn` boolean, required: Do not warn users if on older, but supported major version
            - `dont_block` boolean, required: Do not block users if on older, but supported major version
          - `beta_versions` BetaVersionsPolicy
            - `dont_warn` boolean, required: Do not warn users if on beta version
            - `dont_block` boolean, required: Do not block users if on beta version
        - `firewall` object
          - `warn` boolean, required: Warn users if firewall is not enabled
          - `block` boolean, required: Block users if firewall is not enabled
          - `goal` boolean: Goal - whether firewall should be enabled
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `dns` object
          - `dns_servers` string[], required: List of required DNS servers
          - `validation_mode` 'exact_match' | 'exact_with_extra' | 'contains', required: How to validate DNS server configuration
          - `warn` boolean, required: Warn users if requirement is not configured properly
          - `block` boolean, required: Block users if requirement is not configured properly
          - `goal` boolean: Goal - whether dns should be configured properly
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `screen_sharing` object
          - `warn` boolean, required: Warn users if screen sharing is enabled
          - `block` boolean, required: Block users if screen sharing is enabled
          - `goal` boolean: Goal - whether screen sharing should be disabled
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `remote_login` object
          - `warn` boolean, required: Warn users if remote login is enabled
          - `block` boolean, required: Block users if remote login is enabled
          - `goal` boolean: Goal - whether remote login should be disabled
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `remote_management` object
          - `warn` boolean, required: Warn users if remote management is enabled
          - `block` boolean, required: Block users if remote management is enabled
          - `goal` boolean: Goal - whether remote management should be disabled
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `remote_scripting` object
          - `warn` boolean, required: Warn users if remote scripting is enabled
          - `block` boolean, required: Block users if remote scripting is enabled
          - `goal` boolean: Goal - whether remote scripting should be disabled
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `jailbroken` object
          - `warn` boolean, required: Warn users if device is jailbroken
          - `block` boolean, required: Block users if device is jailbroken
          - `goal` boolean: Goal - whether device should not be jailbroken
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `rooted` object
          - `warn` boolean, required: Warn users if device is rooted
          - `block` boolean, required: Block users if device is rooted
          - `goal` boolean: Goal - whether device should not be rooted
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `developer_mode` object
          - `warn` boolean, required: Warn users if developer mode is enabled
          - `block` boolean, required: Block users if developer mode is enabled
          - `goal` boolean: Goal - whether developer mode should be disabled
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `secure_boot` object
          - `warn` boolean, required: Warn users if secure boot is not enabled
          - `block` boolean, required: Block users if secure boot is not enabled
          - `goal` boolean: Goal - whether secure boot should be enabled
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `integrity_protection` object
          - `warn` boolean, required: Warn users if integrity protection is not enabled
          - `block` boolean, required: Block users if integrity protection is not enabled
          - `goal` boolean: Goal - whether integrity protection should be enabled
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `find_my_device` object
          - `warn` boolean, required: Warn users if find my device is enabled
          - `block` boolean, required: Block users if find my device is enabled
          - `goal` boolean: Goal - whether find my device should be enabled
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `vanta` object
          - `warn` boolean, required: Warn users if vanta is not enabled
          - `block` boolean, required: Block users if vanta is not enabled
          - `goal` boolean: Goal - whether vanta should be enabled
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `intune` object
          - `tenant_ids` string[], required: List of allowed Intune tenant IDs
          - `external_enrollment_allowed` boolean: Allow devices to be enrolled with an external organisation
          - `warn` boolean, required: Warn users if intune is not enabled
          - `block` boolean, required: Block users if intune is not enabled
          - `goal` boolean: Goal - whether intune should be enabled
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `aikido_safe_chain` object
          - `warn` boolean, required: Warn users if Aikido Safe Chain is not installed and active
          - `block` boolean, required: Block users if Aikido Safe Chain is not installed and active
          - `goal` boolean: Goal - whether Aikido Safe Chain should be installed and active
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `aikido_endpoint` object
          - `endpoint_token` string: Aikido Endpoint registration token used for self-installation and tenant association
          - `warn` boolean, required: Warn users if Aikido Endpoint is not installed and active
          - `block` boolean, required: Block users if Aikido Endpoint is not installed and active
          - `goal` boolean: Goal - whether Aikido Endpoint should be installed and active
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `secrets_in_environment` object
          - `warn` boolean, required: Warn users if secrets are detected in environment
          - `block` boolean, required: Block users if secrets are detected in environment
          - `goal` boolean: Goal - whether secrets should not be in environment
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `autonomous_agents_present` object
          - `warn` boolean, required: Warn users if autonomous agents are present
          - `block` boolean, required: Block users if autonomous agents are present
          - `goal` boolean: Goal - whether autonomous agents should not be present
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `unsafe_ai_mode` object
          - `warn` boolean, required: Warn users if unsafe AI configurations are detected
          - `block` boolean, required: Block users if unsafe AI configurations are detected
          - `goal` boolean: Goal - whether unsafe AI configurations should not be present
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `unguarded_elevation` object
          - `warn` boolean, required: Warn users if unguarded elevation is detected
          - `block` boolean, required: Block users if unguarded elevation is detected
          - `goal` boolean: Goal - whether unguarded elevation should not be present
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `chrome_safebrowsing_enabled` object
          - `warn` boolean, required: Warn users if Chrome Safe Browsing is not enabled
          - `block` boolean, required: Block users if Chrome Safe Browsing is not enabled
          - `goal` boolean: Goal - whether Chrome Safe Browsing should be enabled
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `chrome_safebrowsing_enhanced` object
          - `warn` boolean, required: Warn users if Chrome Enhanced Safe Browsing is not enabled
          - `block` boolean, required: Block users if Chrome Enhanced Safe Browsing is not enabled
          - `goal` boolean: Goal - whether Chrome Enhanced Safe Browsing should be enabled
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `chrome_do_not_track` object
          - `warn` boolean, required: Warn users if Chrome Do Not Track is not enabled
          - `block` boolean, required: Block users if Chrome Do Not Track is not enabled
          - `goal` boolean: Goal - whether Chrome Do Not Track should be enabled
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `chrome_dns_over_https` object
          - `warn` boolean, required: Warn users if Chrome DNS over HTTPS is not enabled
          - `block` boolean, required: Block users if Chrome DNS over HTTPS is not enabled
          - `goal` boolean: Goal - whether Chrome DNS over HTTPS should be enabled
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `firefox_https_only` object
          - `warn` boolean, required: Warn users if Firefox HTTPS-Only mode is not enabled
          - `block` boolean, required: Block users if Firefox HTTPS-Only mode is not enabled
          - `goal` boolean: Goal - whether Firefox HTTPS-Only mode should be enabled
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `firefox_dns_over_https` object
          - `warn` boolean, required: Warn users if Firefox DNS over HTTPS is not enabled
          - `block` boolean, required: Block users if Firefox DNS over HTTPS is not enabled
          - `goal` boolean: Goal - whether Firefox DNS over HTTPS should be enabled
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `firefox_enhanced_tracking_protection` object
          - `warn` boolean, required: Warn users if Firefox Enhanced Tracking Protection is not enabled
          - `block` boolean, required: Block users if Firefox Enhanced Tracking Protection is not enabled
          - `goal` boolean: Goal - whether Firefox Enhanced Tracking Protection should be enabled
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `firefox_enhanced_tracking_protection_strict` object
          - `warn` boolean, required: Warn users if Firefox Enhanced Tracking Protection strict mode is not enabled
          - `block` boolean, required: Block users if Firefox Enhanced Tracking Protection strict mode is not enabled
          - `goal` boolean: Goal - whether Firefox Enhanced Tracking Protection strict mode should be enabled
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `unattended_remote_access` object
          - `warn` boolean, required: Warn users if unattended remote access tools are configured
          - `block` boolean, required: Block users if unattended remote access tools are configured
          - `goal` boolean: Goal - whether unattended remote access tools should not be configured
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `install_protection` object: Policy for the OS-level install protection guardrail (Gatekeeper on macOS, SmartScreen / Defender PUA on Windows).
          - `warn` boolean, required: Warn users if install protection is not enabled
          - `block` boolean, required: Block users if install protection is not enabled
          - `goal` boolean: Goal - whether install protection should be enabled
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `no_revoked_signature_apps` object: Policy for apps whose code-signing certificate has been revoked by the OS.
          - `warn` boolean, required: Warn users if apps with revoked signatures are present
          - `block` boolean, required: Block users if apps with revoked signatures are present
          - `goal` boolean: Goal - whether apps with revoked signatures should be absent
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `no_tampered_apps` object: Policy for apps whose binary does not match its code signature.
          - `warn` boolean, required: Warn users if tampered apps are present
          - `block` boolean, required: Block users if tampered apps are present
          - `goal` boolean: Goal - whether tampered apps should be absent
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `no_untrusted_signer_apps` object: Policy for apps signed by an untrusted or unknown developer.
          - `warn` boolean, required: Warn users if apps from untrusted signers are present
          - `block` boolean, required: Block users if apps from untrusted signers are present
          - `goal` boolean: Goal - whether apps from untrusted signers should be absent
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `no_unsigned_apps` object: Policy for apps that carry no code signature at all.
          - `warn` boolean, required: Warn users if unsigned apps are present
          - `block` boolean, required: Block users if unsigned apps are present
          - `goal` boolean: Goal - whether unsigned apps should be absent
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `no_adhoc_signed_apps` object: Policy for apps that carry only an ad-hoc (self-issued) signature.
          - `warn` boolean, required: Warn users if ad-hoc signed apps are present
          - `block` boolean, required: Block users if ad-hoc signed apps are present
          - `goal` boolean: Goal - whether ad-hoc signed apps should be absent
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `no_unnotarized_apps` object: Policy for macOS apps signed with a Developer ID but without Apple notarization.
          - `warn` boolean, required: Warn users if apps without notarization are present
          - `block` boolean, required: Block users if apps without notarization are present
          - `goal` boolean: Goal - whether apps without notarization should be absent
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `no_cryptominers` object: Policy for cryptominer applications.
          - `warn` boolean, required: Warn users if cryptominer applications are present
          - `block` boolean, required: Block users if cryptominer applications are present
          - `goal` boolean: Goal - whether cryptominer applications should be absent
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `no_hacking_pentest` object: Policy for hacking and pentest tools.
          - `warn` boolean, required: Warn users if hacking and pentest tools are present
          - `block` boolean, required: Block users if hacking and pentest tools are present
          - `goal` boolean: Goal - whether hacking and pentest tools should be absent
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `no_piracy_p2p` object: Policy for piracy and peer-to-peer applications.
          - `warn` boolean, required: Warn users if piracy and P2P applications are present
          - `block` boolean, required: Block users if piracy and P2P applications are present
          - `goal` boolean: Goal - whether piracy and P2P applications should be absent
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `no_jailbreak_rooting` object: Policy for jailbreak and rooting tools.
          - `warn` boolean, required: Warn users if jailbreak and rooting tools are present
          - `block` boolean, required: Block users if jailbreak and rooting tools are present
          - `goal` boolean: Goal - whether jailbreak and rooting tools should be absent
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `no_vpn_clients` object: Policy for VPN clients.
          - `warn` boolean, required: Warn users if VPN clients are present
          - `block` boolean, required: Block users if VPN clients are present
          - `goal` boolean: Goal - whether VPN clients should be absent
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `no_third_party_ai_coding` object: Policy for third-party AI coding tools.
          - `warn` boolean, required: Warn users if third-party AI coding tools are present
          - `block` boolean, required: Block users if third-party AI coding tools are present
          - `goal` boolean: Goal - whether third-party AI coding tools should be absent
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `no_experimental_browsers` object: Policy for experimental browsers.
          - `warn` boolean, required: Warn users if experimental browsers are present
          - `block` boolean, required: Block users if experimental browsers are present
          - `goal` boolean: Goal - whether experimental browsers should be absent
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `no_virtualization` object: Policy for virtualization software.
          - `warn` boolean, required: Warn users if virtualization software is present
          - `block` boolean, required: Block users if virtualization software is present
          - `goal` boolean: Goal - whether virtualization software should be absent
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `no_games` object: Policy for games and gaming tools.
          - `warn` boolean, required: Warn users if games or gaming tools are present
          - `block` boolean, required: Block users if games or gaming tools are present
          - `goal` boolean: Goal - whether games and gaming tools should be absent
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
        - `no_permission_hungry` object: Policy for applications that request unusually broad system permissions.
          - `warn` boolean, required: Warn users if permission-hungry applications are present
          - `block` boolean, required: Block users if permission-hungry applications are present
          - `goal` boolean: Goal - whether permission-hungry applications should be absent
          - `escalation` CheckEscalation
            - `mode` 'grace_days', required
            - `block_after_days` integer
      - `allowedApplicationDomainRegexes` string[], required: Allowed application domain regexes
      - `publicCerts` string[], required: Public certificates
      - `SAMLMetadataUrl` string, required: SAML Metadata URL
      - `SAMLConfiguration` SAMLConfiguration
        - `enabled` boolean, required: Indicates if SAML is enabled
        - `service_provider_assertion_consumer_service_url` string, required: URL for the service provider's assertion consumer service
        - `identity_provider_sso_url` string, required: URL for the identity provider's SSO
        - `identity_provider_issuer` string, required: Issuer for the identity provider
        - `identity_provider_public_certificate` string, required: Public certificate for the identity provider
        - `sign_response` boolean, required: Indicates if the response should be signed
        - `factor_only` boolean: Indicates if only factor authentication is used
        - `factor_only_audience` string: Audience for factor-only authentication
        - `force_reauthentication` boolean: Indicates if reauthentication is forced
        - `prevent_passive_login` boolean: Indicates if passive login is prevented
        - `azure_force_account_chooser` boolean: Indicates if Azure account chooser is forced
        - `google_force_account_chooser` boolean: Indicates if Google account chooser is forced
        - `service_provider_signing_certificate` string: Service provider's signing certificate (PEM) used to verify signed SP requests
        - `service_provider_entity_id` string: Service provider's entity ID used to verify signed SP requests
      - `OAuthConfiguration` OAuthConfiguration
        - `enabled` boolean, required: Indicates if OAuth is enabled
        - `redirect_url_to_client` string: URL to redirect to the client
        - `token_endpoint_of_provider` string: Token endpoint of the provider
        - `authorize_endpoint_of_provider` string: The provider's OAuth2 authorization endpoint. When set, XFA performs the device check before redirecting the user to the provider's authorize endpoint, so the provider's authorization code is minted after the device check rather than before it (which prevents the code expiring during the check). When omitted, the existing flow is used unchanged.
      - `clientSecret` string: Client secret
      - `SSOUrl` string, required: SSO URL
      - `issuer` string, required: Issuer
      - `customSessionDurationInHours` integer: Custom session duration in hours
      - `filteredEmail` string[], required: Filtered email addresses
      - `filterMobile` boolean: Filter mobile devices
      - `filterDesktop` boolean: Filter desktop devices
      - `filteredOS` string[]: Filtered operating systems
      - `enableMfa` boolean: Enable MFA
      - `enableMfaAutoApproveFirstDevice` boolean: Enable MFA auto-approve first device
      - `alwaysVerifyMfa` boolean: Double Identity Verification
      - `uniquePurpose` 'DashboardDemo': Unique purpose of the application
      - `enabled` boolean: Enabled
      - `allowedEmailDomains` string[]: Allowed email-domain allow-list for the IdP connection
      - `mfaFirst` boolean: Run passkey/MFA before device posture (IdP connection)
      - `requireEmailVerification` boolean: Require recovery-email proof at onboarding (IdP connection)
      - `IdPProvider` 'Google': Branded provider of an IdP connection, such as a Google Workspace connection. Only valid when type is IdP; unrelated to the Google type (Workspace device discovery). Cannot be cleared once set.
      - `googleConnection` GoogleConnection
        - `scopes` string[], required
        - `error_mobile_devices_api` string: Error message for mobile devices API
        - `email` string: Email of the Google connection
        - `error_cloud_identity_api` string: Error message for Cloud Identity API
        - `only_unmanaged` boolean: Only unmanaged devices
        - `only_groups` object[], required: only discover devices in these groups (empty means all groups)
          - `name` string
          - `id` string
        - `exclude_desktop` boolean: Exclude desktop devices
        - `exclude_mobile` boolean: Exclude mobile devices
        - `last_error` string: Last error message
        - `first_full_read_done` boolean: Whether the first full discovery read completed successfully
      - `microsoftConnection` MicrosoftConnection
        - `scopes` string[], required: List of scopes for the Microsoft connection
        - `last_error` string: Last error message
        - `only_unmanaged` boolean: Only discover unmanaged devices
        - `only_groups` object[], required: Only discover devices from users in these groups (no groups means all groups)
          - `name` string: Name of the group
          - `id` string: ID of the group
        - `exclude_desktop` boolean: Exclude desktop devices
        - `exclude_mobile` boolean: Exclude mobile devices
        - `last_sync` integer: Last time the devices were discovered
        - `discovered_until` integer: Unix time up until which devices have been discovered (for pagination)
        - `first_full_read_done` boolean: Whether the first full discovery read completed successfully
      - `oktaConnection` OktaConnection
        - `okta_domain` string, required: Domain of the Okta connection
        - `client_id` string, required: Client ID for the Okta connection
        - `client_secret` string, required: Client secret for the Okta connection
        - `last_error` string: Last error message
        - `last_sync` integer: Last time the devices were discovered
        - `discovered_until` integer: Unix time up until which devices have been discovered (for pagination)
        - `first_full_read_done` boolean: Whether the first full discovery read completed successfully
    - `decisions` Decisions: Policy decisions for the device, keyed by check. Every entry has a status except the browser entries (chrome, firefox, edge, safari, opera, brave, chromium, vivaldi, arc), which are BrowserDecision objects holding nested decisions and no status: consumers iterating over decisions must skip them or read their nested decisions.
      - `affiliated` DecisionAffiliated
        - `status` string, required
      - `antivirus` DecisionAntivirus: Antivirus decision: which required antivirus product was found, or why the check fails.
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `enabled` boolean: Is the check enabled?
        - `reason` 'product_missing' | 'product_inactive' | 'definitions_outdated' | 'status_unknown' | 'client_update_required' | 'inventory_unavailable': Why the check does not pass. Absent when it passes.
        - `required_products` string[]: Antivirus products the policy accepts
        - `matched_product_id` string: The accepted antivirus product found on the device
      - `beta_browser_version` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `beta_os_version` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `browser_up_to_date` DecisionVersion
        - `status` string, required
        - `latest_version` string, required
        - `time_since_outdated` integer, required
        - `time_till_blocked` integer
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
      - `disk_encryption` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `installed` DecisionInstalled
        - `status` string, required
      - `mfa` DecisionMfa
        - `autoApprove` boolean
        - `autoApproved` boolean
        - `credentials` object
          - `credentials` object[]
            - `deviceId` string
            - `id` string
          - `displayName` string
          - `id` string
          - `name` string
          - `userId` string
        - `error` string
        - `status` string, required
      - `older_supported_browser_version` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `older_supported_os_version` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `os_autoupdate` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `os_up_to_date` DecisionVersion
        - `status` string, required
        - `latest_version` string, required
        - `time_since_outdated` integer, required
        - `time_till_blocked` integer
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
      - `passwordmanager` DecisionPasswordmanager
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
      - `screenlock` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `skip` DecisionSkip
        - `limit` integer
        - `remaining` integer
        - `allowed` boolean, required
      - `unsupported` DecisionUnsupported
        - `allowed` boolean, required
      - `biometrics` DecisionBiometrics
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` 'OK' | 'WARNING' | 'BLOCKING', required: status of decision
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `firewall` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `screen_sharing` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `remote_login` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `remote_management` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `remote_scripting` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `unattended_remote_access` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `reboot` DecisionReboot
        - `status` 'OK' | 'WARNING' | 'BLOCKING', required: status of decision
        - `time_since_last_reboot` integer, required
        - `time_till_blocked` integer
        - `time_since_blocked` integer
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
      - `windows_recall` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `xfa_version` DecisionVersionInDays
        - `status` 'OK' | 'WARNING' | 'BLOCKING', required: status of decision
        - `latest_version` string, required: the latest version
        - `time_since_outdated` integer, required
        - `days_till_blocked` integer
        - `days_since_blocked` integer
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
      - `dns` DecisionDNS
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `dnsServers` string[], nullable: List of DNS servers. Can be null when the statistics service has none.
        - `validationMode` 'exact_match' | 'exact_with_extra' | 'contains' | '': DNS validation mode. An empty string means the statistics service did not set it.
        - `requiredDnsServers` string[], nullable: List of required DNS servers. Can be null when the statistics service has none.
      - `aikido_safe_chain` DecisionAikido: Decision for Aikido device checks (Safe Chain or Endpoint). Combines presence + version posture under a single status.
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` 'OK' | 'WARNING' | 'BLOCKING', required: Status of the decision (OK / WARNING / BLOCKING)
        - `installed` boolean: Whether the Aikido product is installed on the device
        - `active` boolean: Whether the Aikido product is active (Safe Chain shell integration on PATH; Endpoint system extension running)
        - `version` string: Installed version on the device
        - `latest_version` string: Latest known version (from xfa-versions-service)
        - `up_to_date` boolean: Whether the installed version matches the latest known version
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
        - `endpoint_token` string: Aikido Endpoint registration token, used by the XFA app for one-click self-installation and tenant association. Only on aikido_endpoint, and only when a token is set on the policy.
      - `aikido_endpoint` DecisionAikido: Decision for Aikido device checks (Safe Chain or Endpoint). Combines presence + version posture under a single status.
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` 'OK' | 'WARNING' | 'BLOCKING', required: Status of the decision (OK / WARNING / BLOCKING)
        - `installed` boolean: Whether the Aikido product is installed on the device
        - `active` boolean: Whether the Aikido product is active (Safe Chain shell integration on PATH; Endpoint system extension running)
        - `version` string: Installed version on the device
        - `latest_version` string: Latest known version (from xfa-versions-service)
        - `up_to_date` boolean: Whether the installed version matches the latest known version
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
        - `endpoint_token` string: Aikido Endpoint registration token, used by the XFA app for one-click self-installation and tenant association. Only on aikido_endpoint, and only when a token is set on the policy.
      - `unsigned_applications` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `tampered_applications` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `revoked_signature_applications` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `untrusted_publisher_applications` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `unnotarized_applications` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `adhoc_signed_applications` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `cryptominer_applications` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `hacking_tool_applications` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `jailbreak_tool_applications` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `piracy_p2p_applications` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `third_party_ai_coding_applications` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `experimental_browser_applications` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `game_applications` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `permission_hungry_applications` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `virtualization_applications` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `vpn_client_applications` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `install_protection` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `jailbroken` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `rooted` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `developer_mode` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `find_my_device` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `secure_boot` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `integrity_protection` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `vanta` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `secrets_in_environment` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `autonomous_agents_present` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `unguarded_elevation` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `unsafe_ai_mode` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `chrome_safebrowsing_enabled` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `chrome_safebrowsing_enhanced` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `chrome_do_not_track` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `chrome_dns_over_https` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `firefox_https_only` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `firefox_dns_over_https` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `firefox_enhanced_tracking_protection` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `firefox_enhanced_tracking_protection_strict` DecisionEnabled
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enabled` boolean: Is the check enabled?
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `intune` DecisionIntune
        - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
        - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
        - `status` string, required
        - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
        - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
        - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `enabled` boolean: Is the check enabled?
        - `enrolled_in_external_tenant` boolean: Whether the device is enrolled in an external tenant (not in the policy's tenant ID list)
      - `chrome` BrowserDecision: Per-browser decisions for one installed browser. Unlike every other decision, a browser entry has no status of its own: it is a nested object holding the browser's own decisions. Consumers iterating over decisions must skip browser entries (or read their nested decisions) instead of reading status.
        - `browser_name` string, required
        - `up_to_date` DecisionVersion
          - `status` string, required
          - `latest_version` string, required
          - `time_since_outdated` integer, required
          - `time_till_blocked` integer
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `beta_version` DecisionEnabled
          - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
          - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
          - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
          - `status` string, required
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enabled` boolean: Is the check enabled?
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
          - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
        - `older_supported_version` DecisionEnabled
          - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
          - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
          - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
          - `status` string, required
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enabled` boolean: Is the check enabled?
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
          - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `firefox` BrowserDecision: Per-browser decisions for one installed browser. Unlike every other decision, a browser entry has no status of its own: it is a nested object holding the browser's own decisions. Consumers iterating over decisions must skip browser entries (or read their nested decisions) instead of reading status.
        - `browser_name` string, required
        - `up_to_date` DecisionVersion
          - `status` string, required
          - `latest_version` string, required
          - `time_since_outdated` integer, required
          - `time_till_blocked` integer
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `beta_version` DecisionEnabled
          - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
          - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
          - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
          - `status` string, required
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enabled` boolean: Is the check enabled?
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
          - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
        - `older_supported_version` DecisionEnabled
          - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
          - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
          - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
          - `status` string, required
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enabled` boolean: Is the check enabled?
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
          - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `edge` BrowserDecision: Per-browser decisions for one installed browser. Unlike every other decision, a browser entry has no status of its own: it is a nested object holding the browser's own decisions. Consumers iterating over decisions must skip browser entries (or read their nested decisions) instead of reading status.
        - `browser_name` string, required
        - `up_to_date` DecisionVersion
          - `status` string, required
          - `latest_version` string, required
          - `time_since_outdated` integer, required
          - `time_till_blocked` integer
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `beta_version` DecisionEnabled
          - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
          - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
          - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
          - `status` string, required
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enabled` boolean: Is the check enabled?
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
          - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
        - `older_supported_version` DecisionEnabled
          - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
          - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
          - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
          - `status` string, required
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enabled` boolean: Is the check enabled?
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
          - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `safari` BrowserDecision: Per-browser decisions for one installed browser. Unlike every other decision, a browser entry has no status of its own: it is a nested object holding the browser's own decisions. Consumers iterating over decisions must skip browser entries (or read their nested decisions) instead of reading status.
        - `browser_name` string, required
        - `up_to_date` DecisionVersion
          - `status` string, required
          - `latest_version` string, required
          - `time_since_outdated` integer, required
          - `time_till_blocked` integer
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `beta_version` DecisionEnabled
          - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
          - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
          - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
          - `status` string, required
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enabled` boolean: Is the check enabled?
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
          - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
        - `older_supported_version` DecisionEnabled
          - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
          - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
          - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
          - `status` string, required
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enabled` boolean: Is the check enabled?
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
          - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `opera` BrowserDecision: Per-browser decisions for one installed browser. Unlike every other decision, a browser entry has no status of its own: it is a nested object holding the browser's own decisions. Consumers iterating over decisions must skip browser entries (or read their nested decisions) instead of reading status.
        - `browser_name` string, required
        - `up_to_date` DecisionVersion
          - `status` string, required
          - `latest_version` string, required
          - `time_since_outdated` integer, required
          - `time_till_blocked` integer
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `beta_version` DecisionEnabled
          - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
          - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
          - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
          - `status` string, required
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enabled` boolean: Is the check enabled?
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
          - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
        - `older_supported_version` DecisionEnabled
          - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
          - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
          - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
          - `status` string, required
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enabled` boolean: Is the check enabled?
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
          - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `brave` BrowserDecision: Per-browser decisions for one installed browser. Unlike every other decision, a browser entry has no status of its own: it is a nested object holding the browser's own decisions. Consumers iterating over decisions must skip browser entries (or read their nested decisions) instead of reading status.
        - `browser_name` string, required
        - `up_to_date` DecisionVersion
          - `status` string, required
          - `latest_version` string, required
          - `time_since_outdated` integer, required
          - `time_till_blocked` integer
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `beta_version` DecisionEnabled
          - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
          - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
          - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
          - `status` string, required
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enabled` boolean: Is the check enabled?
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
          - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
        - `older_supported_version` DecisionEnabled
          - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
          - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
          - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
          - `status` string, required
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enabled` boolean: Is the check enabled?
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
          - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `chromium` BrowserDecision: Per-browser decisions for one installed browser. Unlike every other decision, a browser entry has no status of its own: it is a nested object holding the browser's own decisions. Consumers iterating over decisions must skip browser entries (or read their nested decisions) instead of reading status.
        - `browser_name` string, required
        - `up_to_date` DecisionVersion
          - `status` string, required
          - `latest_version` string, required
          - `time_since_outdated` integer, required
          - `time_till_blocked` integer
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `beta_version` DecisionEnabled
          - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
          - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
          - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
          - `status` string, required
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enabled` boolean: Is the check enabled?
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
          - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
        - `older_supported_version` DecisionEnabled
          - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
          - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
          - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
          - `status` string, required
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enabled` boolean: Is the check enabled?
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
          - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `vivaldi` BrowserDecision: Per-browser decisions for one installed browser. Unlike every other decision, a browser entry has no status of its own: it is a nested object holding the browser's own decisions. Consumers iterating over decisions must skip browser entries (or read their nested decisions) instead of reading status.
        - `browser_name` string, required
        - `up_to_date` DecisionVersion
          - `status` string, required
          - `latest_version` string, required
          - `time_since_outdated` integer, required
          - `time_till_blocked` integer
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `beta_version` DecisionEnabled
          - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
          - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
          - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
          - `status` string, required
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enabled` boolean: Is the check enabled?
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
          - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
        - `older_supported_version` DecisionEnabled
          - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
          - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
          - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
          - `status` string, required
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enabled` boolean: Is the check enabled?
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
          - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
      - `arc` BrowserDecision: Per-browser decisions for one installed browser. Unlike every other decision, a browser entry has no status of its own: it is a nested object holding the browser's own decisions. Consumers iterating over decisions must skip browser entries (or read their nested decisions) instead of reading status.
        - `browser_name` string, required
        - `up_to_date` DecisionVersion
          - `status` string, required
          - `latest_version` string, required
          - `time_since_outdated` integer, required
          - `time_till_blocked` integer
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
        - `beta_version` DecisionEnabled
          - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
          - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
          - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
          - `status` string, required
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enabled` boolean: Is the check enabled?
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
          - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.
        - `older_supported_version` DecisionEnabled
          - `first_seen_at` string: First failing sign-in on this device, as RFC3339 UTC. This one-time date never resets.
          - `block_at` string: RFC3339 UTC deadline for a one-time grace period.
          - `reason` 'not_shared' | 'no_permission' | 'not_configured': Why a decision has no device value. not_shared: the person does not share this check with the organization (affiliation sharing); status is the policy's severity (BLOCKING, WARNING, or OK for a goal-only check). Only not_shared is used today; the others are reserved (XFA-3686). Absent on a normal decision.
          - `status` string, required
          - `fix_supported` boolean: Whether the XFA app on this device can fix this check itself, after the person clicks and confirms. Absent when the policy engine does not report it.
          - `enabled` boolean: Is the check enabled?
          - `enforced` boolean: Whether this check is enforced towards the user: the policy warns and/or blocks on it. False means the policy only tracks a compliance goal, which is dashboard-only, so clients must not present the check to the user as passed or failed. Absent when enforcement could not be determined; treat absent as enforced.
          - `goal_status` 'OK' | 'NOK' | 'UNKNOWN' | 'NOT_REQUIRED' | '': Goal status of the decision, based on the policy's compliance goal and goal time. An empty string means the statistics service did not set it.
          - `covered_by` string: Set when the check passes because another check covers it, naming that check's key. Today only aikido_safe_chain, covered by aikido_endpoint. Absent when the check passes on its own.

---

[API](https://skmtc.dev/xfa/apis/xfa-api.md) · [All operations](https://skmtc.dev/xfa/apis/xfa-api/llms.txt) · [OpenAPI document](https://skmtc.dev/xfa/apis/xfa-api/revisions/1a1be0e8972b?raw)