Add device data model and ITAM service

Introduce device, posture, and enrollment-token entities with ITAM service policies for agent-managed fleet inventory. Signed-off-by: Ludovic Vielle <ludovic@probo.com>
2026-07-14 20:38:38 +02:00
parent fa3b7dc2b3
commit 1f79453386
21 changed files with 3591 additions and 0 deletions
--- a/pkg/coredata/device.go
+++ b/pkg/coredata/device.go
@@ -0,0 +1,896 @@
+// Copyright (c) 2025-2026 Probo Inc <hello@probo.com>.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/iam/policy"
+	"go.probo.inc/probo/pkg/page"
+)
+
+var emptyJSONObject = json.RawMessage(`{}`)
+
+type (
+	Device struct {
+		ID             gid.GID         `db:"id"`
+		TenantID       gid.TenantID    `db:"tenant_id"`
+		OrganizationID gid.GID         `db:"organization_id"`
+		State          DeviceState     `db:"state"`
+		HardwareUUID   *string         `db:"hardware_uuid"`
+		SerialNumber   *string         `db:"serial_number"`
+		Hostname       *string         `db:"hostname"`
+		Platform       *DevicePlatform `db:"platform"`
+		OSVersion      *string         `db:"os_version"`
+		AgentVersion   *string         `db:"agent_version"`
+		APIKeyHash     []byte          `db:"api_key_hash"`
+		OwnerID        *gid.GID        `db:"owner_profile_id"`
+		Labels         json.RawMessage `db:"labels"`
+		EnrolledAt     *time.Time      `db:"enrolled_at"`
+		LastSeenAt     *time.Time      `db:"last_seen_at"`
+		RevokedAt      *time.Time      `db:"revoked_at"`
+		CreatedAt      time.Time       `db:"created_at"`
+		UpdatedAt      time.Time       `db:"updated_at"`
+	}
+
+	Devices []*Device
+)
+
+func (d *Device) CursorKey(orderBy DeviceOrderField) page.CursorKey {
+	switch orderBy {
+	case DeviceOrderFieldCreatedAt:
+		return page.NewCursorKey(d.ID, d.CreatedAt)
+	case DeviceOrderFieldUpdatedAt:
+		return page.NewCursorKey(d.ID, d.UpdatedAt)
+	case DeviceOrderFieldHostname:
+		hostname := ""
+		if d.Hostname != nil {
+			hostname = *d.Hostname
+		}
+
+		return page.NewCursorKey(d.ID, hostname)
+	case DeviceOrderFieldLastSeenAt:
+		lastSeen := time.Time{}
+		if d.LastSeenAt != nil {
+			lastSeen = *d.LastSeenAt
+		}
+
+		return page.NewCursorKey(d.ID, lastSeen)
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
+}
+
+func (d *Device) AuthorizationAttributes(
+	ctx context.Context,
+	conn pg.Querier,
+	resourceIDs []gid.GID,
+) (policy.AttributesByID, error) {
+	q := `
+SELECT
+    id,
+    organization_id,
+    owner_profile_id
+FROM
+    devices
+WHERE
+    id = ANY(@resource_ids::text[])
+`
+
+	rows, err := conn.Query(ctx, q, pgx.StrictNamedArgs{"resource_ids": resourceIDs})
+	if err != nil {
+		return nil, fmt.Errorf("cannot query device authorization attributes: %w", err)
+	}
+	defer rows.Close()
+
+	attrsByID := make(policy.AttributesByID, len(resourceIDs))
+	ownerProfileByDeviceID := make(map[gid.GID]*gid.GID, len(resourceIDs))
+	profileIDSet := make(map[gid.GID]struct{})
+
+	for rows.Next() {
+		var (
+			id, organizationID gid.GID
+			ownerProfileID     *gid.GID
+		)
+		if err := rows.Scan(&id, &organizationID, &ownerProfileID); err != nil {
+			return nil, fmt.Errorf("cannot scan device authorization attributes: %w", err)
+		}
+
+		attrsByID[id] = policy.Attributes{
+			"organization_id": organizationID.String(),
+		}
+		ownerProfileByDeviceID[id] = ownerProfileID
+
+		if ownerProfileID != nil {
+			profileIDSet[*ownerProfileID] = struct{}{}
+		}
+	}
+
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("cannot iterate device authorization attributes: %w", err)
+	}
+
+	if len(profileIDSet) > 0 {
+		profileIDs := make([]gid.GID, 0, len(profileIDSet))
+		for profileID := range profileIDSet {
+			profileIDs = append(profileIDs, profileID)
+		}
+
+		var profile MembershipProfile
+
+		profileAttrsByID, err := profile.AuthorizationAttributes(ctx, conn, profileIDs)
+		if err != nil {
+			return nil, fmt.Errorf("cannot load profile authorization attributes: %w", err)
+		}
+
+		identityByProfileID := make(map[gid.GID]string, len(profileAttrsByID))
+		for profileID, profileAttrs := range profileAttrsByID {
+			if identityID, ok := profileAttrs["identity_id"]; ok {
+				identityByProfileID[profileID] = identityID
+			}
+		}
+
+		for deviceID, ownerProfileID := range ownerProfileByDeviceID {
+			if ownerProfileID == nil {
+				continue
+			}
+
+			if ownerIdentityID, ok := identityByProfileID[*ownerProfileID]; ok {
+				attrsByID[deviceID]["owner_id"] = ownerIdentityID
+			}
+		}
+	}
+
+	return attrsByID, nil
+}
+
+func (d *Device) LoadByID(
+	ctx context.Context,
+	conn pg.Querier,
+	scope Scoper,
+	deviceID gid.GID,
+) error {
+	q := `
+SELECT
+	id,
+	tenant_id,
+	organization_id,
+	state,
+	hardware_uuid,
+	serial_number,
+	hostname,
+	platform,
+	os_version,
+	agent_version,
+	api_key_hash,
+	owner_profile_id,
+	labels,
+	enrolled_at,
+	last_seen_at,
+	revoked_at,
+	created_at,
+	updated_at
+FROM
+	devices
+WHERE
+	%s
+	AND id = @device_id
+LIMIT 1;
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"device_id": deviceID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query device: %w", err)
+	}
+
+	device, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Device])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+
+		return fmt.Errorf("cannot collect device: %w", err)
+	}
+
+	*d = device
+
+	return nil
+}
+
+func (d *Device) LoadByIDForUpdate(
+	ctx context.Context,
+	conn pg.Tx,
+	scope Scoper,
+	deviceID gid.GID,
+) error {
+	q := `
+SELECT
+	id,
+	tenant_id,
+	organization_id,
+	state,
+	hardware_uuid,
+	serial_number,
+	hostname,
+	platform,
+	os_version,
+	agent_version,
+	api_key_hash,
+	owner_profile_id,
+	labels,
+	enrolled_at,
+	last_seen_at,
+	revoked_at,
+	created_at,
+	updated_at
+FROM
+	devices
+WHERE
+	%s
+	AND id = @device_id
+LIMIT 1
+FOR UPDATE;
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"device_id": deviceID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query device: %w", err)
+	}
+
+	device, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Device])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+
+		return fmt.Errorf("cannot collect device: %w", err)
+	}
+
+	*d = device
+
+	return nil
+}
+
+// LoadByAPIKeyHash loads a non-revoked device by its API key hash without
+// requiring a tenant scope (the device key itself is the credential).
+func (d *Device) LoadByAPIKeyHash(
+	ctx context.Context,
+	conn pg.Querier,
+	apiKeyHash []byte,
+) error {
+	q := `
+SELECT
+	id,
+	tenant_id,
+	organization_id,
+	state,
+	hardware_uuid,
+	serial_number,
+	hostname,
+	platform,
+	os_version,
+	agent_version,
+	api_key_hash,
+	owner_profile_id,
+	labels,
+	enrolled_at,
+	last_seen_at,
+	revoked_at,
+	created_at,
+	updated_at
+FROM
+	devices
+WHERE
+	api_key_hash = @api_key_hash
+	AND state != @revoked_state
+LIMIT 1;
+`
+
+	args := pgx.StrictNamedArgs{
+		"api_key_hash":  apiKeyHash,
+		"revoked_state": DeviceStateRevoked,
+	}
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query device by api key hash: %w", err)
+	}
+
+	device, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Device])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+
+		return fmt.Errorf("cannot collect device: %w", err)
+	}
+
+	*d = device
+
+	return nil
+}
+
+func (d *Device) LoadByHardwareUUID(
+	ctx context.Context,
+	conn pg.Querier,
+	scope Scoper,
+	organizationID gid.GID,
+	hardwareUUID string,
+) error {
+	q := `
+SELECT
+	id,
+	tenant_id,
+	organization_id,
+	state,
+	hardware_uuid,
+	serial_number,
+	hostname,
+	platform,
+	os_version,
+	agent_version,
+	api_key_hash,
+	owner_profile_id,
+	labels,
+	enrolled_at,
+	last_seen_at,
+	revoked_at,
+	created_at,
+	updated_at
+FROM
+	devices
+WHERE
+	%s
+	AND organization_id = @organization_id
+	AND hardware_uuid = @hardware_uuid
+LIMIT 1;
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"organization_id": organizationID,
+		"hardware_uuid":   hardwareUUID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query device by hardware uuid: %w", err)
+	}
+
+	device, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Device])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+
+		return fmt.Errorf("cannot collect device: %w", err)
+	}
+
+	*d = device
+
+	return nil
+}
+
+func (d Device) Insert(
+	ctx context.Context,
+	conn pg.Tx,
+	scope Scoper,
+) error {
+	labels := d.Labels
+	if len(labels) == 0 {
+		labels = emptyJSONObject
+	}
+
+	q := `
+INSERT INTO devices (
+    id,
+    tenant_id,
+    organization_id,
+    state,
+    hardware_uuid,
+    serial_number,
+    hostname,
+    platform,
+    os_version,
+    agent_version,
+    api_key_hash,
+    owner_profile_id,
+    labels,
+    enrolled_at,
+    last_seen_at,
+    revoked_at,
+    created_at,
+    updated_at
+) VALUES (
+    @device_id,
+    @tenant_id,
+    @organization_id,
+    @state,
+    @hardware_uuid,
+    @serial_number,
+    @hostname,
+    @platform,
+    @os_version,
+    @agent_version,
+    @api_key_hash,
+    @owner_profile_id,
+    @labels,
+    @enrolled_at,
+    @last_seen_at,
+    @revoked_at,
+    @created_at,
+    @updated_at
+)
+`
+	args := pgx.StrictNamedArgs{
+		"device_id":        d.ID,
+		"tenant_id":        scope.GetTenantID(),
+		"organization_id":  d.OrganizationID,
+		"state":            d.State,
+		"hardware_uuid":    d.HardwareUUID,
+		"serial_number":    d.SerialNumber,
+		"hostname":         d.Hostname,
+		"platform":         d.Platform,
+		"os_version":       d.OSVersion,
+		"agent_version":    d.AgentVersion,
+		"api_key_hash":     d.APIKeyHash,
+		"owner_profile_id": d.OwnerID,
+		"labels":           labels,
+		"enrolled_at":      d.EnrolledAt,
+		"last_seen_at":     d.LastSeenAt,
+		"revoked_at":       d.RevokedAt,
+		"created_at":       d.CreatedAt,
+		"updated_at":       d.UpdatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot insert device: %w", err)
+	}
+
+	return nil
+}
+
+func (d *Device) SetAPIKeyHash(
+	ctx context.Context,
+	conn pg.Tx,
+	scope Scoper,
+	apiKeyHash []byte,
+) error {
+	now := time.Now()
+
+	q := fmt.Sprintf(`
+UPDATE devices
+SET
+    api_key_hash = @api_key_hash,
+    updated_at = @updated_at
+WHERE %s
+    AND id = @device_id
+    AND state = @pending_state
+    AND api_key_hash IS NULL
+`, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"device_id":     d.ID,
+		"api_key_hash":  apiKeyHash,
+		"updated_at":    now,
+		"pending_state": DeviceStatePending,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	result, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		if pgErr, ok := errors.AsType[*pgconn.PgError](err); ok && pgErr.Code == "23505" && pgErr.ConstraintName == "devices_api_key_hash_idx" {
+			return ErrResourceAlreadyExists
+		}
+
+		return fmt.Errorf("cannot set device api key hash: %w", err)
+	}
+
+	if result.RowsAffected() == 0 {
+		return ErrResourceNotFound
+	}
+
+	d.APIKeyHash = apiKeyHash
+	d.UpdatedAt = now
+
+	return nil
+}
+
+func (d *Device) Activate(
+	ctx context.Context,
+	conn pg.Tx,
+	scope Scoper,
+) error {
+	now := time.Now()
+
+	q := fmt.Sprintf(`
+UPDATE devices
+SET
+    hardware_uuid = @hardware_uuid,
+    serial_number = @serial_number,
+    hostname = @hostname,
+    platform = @platform,
+    os_version = @os_version,
+    agent_version = @agent_version,
+    state = @active_state,
+    enrolled_at = @now,
+    last_seen_at = @now,
+    updated_at = @now
+WHERE %s
+    AND id = @device_id
+    AND state = @pending_state
+`, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"device_id":     d.ID,
+		"hardware_uuid": d.HardwareUUID,
+		"serial_number": d.SerialNumber,
+		"hostname":      d.Hostname,
+		"platform":      d.Platform,
+		"os_version":    d.OSVersion,
+		"agent_version": d.AgentVersion,
+		"active_state":  DeviceStateActive,
+		"pending_state": DeviceStatePending,
+		"now":           now,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	result, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		if pgErr, ok := errors.AsType[*pgconn.PgError](err); ok && pgErr.Code == "23505" && pgErr.ConstraintName == "devices_org_hardware_uuid_idx" {
+			return ErrResourceAlreadyExists
+		}
+
+		return fmt.Errorf("cannot activate device: %w", err)
+	}
+
+	if result.RowsAffected() == 0 {
+		return ErrResourceNotFound
+	}
+
+	d.State = DeviceStateActive
+	d.EnrolledAt = &now
+	d.LastSeenAt = &now
+	d.UpdatedAt = now
+
+	return nil
+}
+
+func (d *Device) UpdateHeartbeat(
+	ctx context.Context,
+	conn pg.Tx,
+	scope Scoper,
+) error {
+	now := time.Now()
+
+	q := fmt.Sprintf(`
+UPDATE devices
+SET
+    hostname = @hostname,
+    os_version = @os_version,
+    agent_version = @agent_version,
+    last_seen_at = @last_seen_at,
+    updated_at = @updated_at
+WHERE %s
+    AND id = @device_id
+    AND state = @active_state
+`, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"device_id":     d.ID,
+		"hostname":      d.Hostname,
+		"os_version":    d.OSVersion,
+		"agent_version": d.AgentVersion,
+		"last_seen_at":  now,
+		"updated_at":    now,
+		"active_state":  DeviceStateActive,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	result, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot update device heartbeat: %w", err)
+	}
+
+	if result.RowsAffected() == 0 {
+		return ErrResourceNotFound
+	}
+
+	d.LastSeenAt = &now
+	d.UpdatedAt = now
+
+	return nil
+}
+
+func (d *Device) Revoke(
+	ctx context.Context,
+	conn pg.Tx,
+	scope Scoper,
+) error {
+	now := time.Now()
+
+	q := fmt.Sprintf(`
+UPDATE devices
+SET
+    state = @revoked_state,
+    revoked_at = COALESCE(revoked_at, @now),
+    updated_at = @now
+WHERE %s
+    AND id = @device_id
+`, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"device_id":     d.ID,
+		"revoked_state": DeviceStateRevoked,
+		"now":           now,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	result, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot revoke device: %w", err)
+	}
+
+	if result.RowsAffected() == 0 {
+		return ErrResourceNotFound
+	}
+
+	d.State = DeviceStateRevoked
+	if d.RevokedAt == nil {
+		d.RevokedAt = &now
+	}
+
+	d.UpdatedAt = now
+
+	return nil
+}
+
+func (d *Device) AssignOwner(
+	ctx context.Context,
+	conn pg.Tx,
+	scope Scoper,
+	ownerProfileID *gid.GID,
+) error {
+	now := time.Now()
+
+	q := fmt.Sprintf(`
+UPDATE devices
+SET
+    owner_profile_id = @owner_profile_id,
+    updated_at = @now
+WHERE %s
+    AND id = @device_id
+`, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"device_id":        d.ID,
+		"owner_profile_id": ownerProfileID,
+		"now":              now,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	result, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot assign device user: %w", err)
+	}
+
+	if result.RowsAffected() == 0 {
+		return ErrResourceNotFound
+	}
+
+	d.OwnerID = ownerProfileID
+	d.UpdatedAt = now
+
+	return nil
+}
+
+func (ds *Devices) LoadByOrganizationID(
+	ctx context.Context,
+	conn pg.Querier,
+	scope Scoper,
+	organizationID gid.GID,
+	cursor *page.Cursor[DeviceOrderField],
+) error {
+	q := `
+SELECT
+	id,
+	tenant_id,
+	organization_id,
+	state,
+	hardware_uuid,
+	serial_number,
+	hostname,
+	platform,
+	os_version,
+	agent_version,
+	api_key_hash,
+	owner_profile_id,
+	labels,
+	enrolled_at,
+	last_seen_at,
+	revoked_at,
+	created_at,
+	updated_at
+FROM
+	devices
+WHERE
+	%s
+	AND organization_id = @organization_id
+	AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"organization_id": organizationID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query devices: %w", err)
+	}
+
+	devices, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Device])
+	if err != nil {
+		return fmt.Errorf("cannot collect devices: %w", err)
+	}
+
+	*ds = devices
+
+	return nil
+}
+
+func (ds *Devices) LoadByOrganizationIDAndOwnerID(
+	ctx context.Context,
+	conn pg.Querier,
+	scope Scoper,
+	organizationID gid.GID,
+	ownerID gid.GID,
+	cursor *page.Cursor[DeviceOrderField],
+) error {
+	q := `
+SELECT
+	id,
+	tenant_id,
+	organization_id,
+	state,
+	hardware_uuid,
+	serial_number,
+	hostname,
+	platform,
+	os_version,
+	agent_version,
+	api_key_hash,
+	owner_profile_id,
+	labels,
+	enrolled_at,
+	last_seen_at,
+	revoked_at,
+	created_at,
+	updated_at
+FROM
+	devices
+WHERE
+	%s
+	AND organization_id = @organization_id
+	AND owner_profile_id = @owner_profile_id
+	AND state = @active_state
+	AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"organization_id":  organizationID,
+		"owner_profile_id": ownerID,
+		"active_state":     DeviceStateActive,
+	}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query devices by owner: %w", err)
+	}
+
+	devices, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Device])
+	if err != nil {
+		return fmt.Errorf("cannot collect devices by owner: %w", err)
+	}
+
+	*ds = devices
+
+	return nil
+}
+
+func (ds *Devices) CountByOrganizationID(
+	ctx context.Context,
+	conn pg.Querier,
+	scope Scoper,
+	organizationID gid.GID,
+) (int, error) {
+	q := fmt.Sprintf(`
+SELECT COUNT(id) FROM devices
+WHERE %s AND organization_id = @organization_id
+`, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"organization_id": organizationID}
+	maps.Copy(args, scope.SQLArguments())
+
+	var count int
+	if err := conn.QueryRow(ctx, q, args).Scan(&count); err != nil {
+		return 0, fmt.Errorf("cannot count devices: %w", err)
+	}
+
+	return count, nil
+}
+
+func (ds *Devices) CountByOrganizationIDAndOwnerID(
+	ctx context.Context,
+	conn pg.Querier,
+	scope Scoper,
+	organizationID gid.GID,
+	ownerID gid.GID,
+) (int, error) {
+	q := `
+SELECT
+	COUNT(id)
+FROM
+	devices
+WHERE
+	%s
+	AND organization_id = @organization_id
+	AND owner_profile_id = @owner_profile_id
+	AND state = @active_state
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"organization_id":  organizationID,
+		"owner_profile_id": ownerID,
+		"active_state":     DeviceStateActive,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	var count int
+	if err := conn.QueryRow(ctx, q, args).Scan(&count); err != nil {
+		return 0, fmt.Errorf("cannot count devices by owner: %w", err)
+	}
+
+	return count, nil
+}
--- a/pkg/coredata/device_enrollment_token.go
+++ b/pkg/coredata/device_enrollment_token.go
@@ -0,0 +1,169 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
+)
+
+type DeviceEnrollmentToken struct {
+	ID          gid.GID      `db:"id"`
+	TenantID    gid.TenantID `db:"tenant_id"`
+	DeviceID    gid.GID      `db:"device_id"`
+	HashedValue []byte       `db:"hashed_value"`
+	ExpiresAt   time.Time    `db:"expires_at"`
+	CreatedAt   time.Time    `db:"created_at"`
+}
+
+func (t *DeviceEnrollmentToken) Insert(
+	ctx context.Context,
+	conn pg.Tx,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO device_enrollment_tokens (
+    id,
+    tenant_id,
+    device_id,
+    hashed_value,
+    expires_at,
+    created_at
+) VALUES (
+    @id,
+    @tenant_id,
+    @device_id,
+    @hashed_value,
+    @expires_at,
+    @created_at
+)
+`
+
+	args := pgx.StrictNamedArgs{
+		"id":           t.ID,
+		"tenant_id":    scope.GetTenantID(),
+		"device_id":    t.DeviceID,
+		"hashed_value": t.HashedValue,
+		"expires_at":   t.ExpiresAt,
+		"created_at":   t.CreatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		if pgErr, ok := errors.AsType[*pgconn.PgError](err); ok {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "device_enrollment_tokens_hashed_value_unique" {
+				return ErrResourceAlreadyExists
+			}
+		}
+
+		return fmt.Errorf("cannot insert device_enrollment_token: %w", err)
+	}
+
+	return nil
+}
+
+func (t *DeviceEnrollmentToken) LoadByHashedValueForUpdate(
+	ctx context.Context,
+	conn pg.Tx,
+	hashedValue []byte,
+) error {
+	q := `
+SELECT
+    id,
+    tenant_id,
+    device_id,
+    hashed_value,
+    expires_at,
+    created_at
+FROM
+    device_enrollment_tokens
+WHERE
+    hashed_value = @hashed_value
+LIMIT 1
+FOR UPDATE;
+`
+
+	args := pgx.StrictNamedArgs{"hashed_value": hashedValue}
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query device_enrollment_tokens: %w", err)
+	}
+
+	token, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[DeviceEnrollmentToken])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+
+		return fmt.Errorf("cannot collect device_enrollment_token: %w", err)
+	}
+
+	*t = token
+
+	return nil
+}
+
+func (t *DeviceEnrollmentToken) DeleteExpired(
+	ctx context.Context,
+	conn pg.Tx,
+	now time.Time,
+) (int64, error) {
+	q := `
+DELETE FROM device_enrollment_tokens
+WHERE
+    expires_at < @now
+`
+
+	result, err := conn.Exec(ctx, q, pgx.StrictNamedArgs{"now": now})
+	if err != nil {
+		return 0, fmt.Errorf("cannot delete expired device_enrollment_tokens: %w", err)
+	}
+
+	return result.RowsAffected(), nil
+}
+
+func (t *DeviceEnrollmentToken) Delete(
+	ctx context.Context,
+	conn pg.Tx,
+) error {
+	q := `
+DELETE FROM device_enrollment_tokens
+WHERE
+    id = @id
+`
+
+	args := pgx.StrictNamedArgs{"id": t.ID}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot delete device_enrollment_token: %w", err)
+	}
+
+	return nil
+}
--- a/pkg/coredata/device_order_field.go
+++ b/pkg/coredata/device_order_field.go
@@ -0,0 +1,100 @@
+// Copyright (c) 2025-2026 Probo Inc <hello@probo.com>.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+package coredata
+
+import (
+	"encoding"
+	"fmt"
+
+	"go.probo.inc/probo/pkg/page"
+)
+
+type DeviceOrderField string
+
+const (
+	DeviceOrderFieldCreatedAt  DeviceOrderField = "CREATED_AT"
+	DeviceOrderFieldUpdatedAt  DeviceOrderField = "UPDATED_AT"
+	DeviceOrderFieldHostname   DeviceOrderField = "HOSTNAME"
+	DeviceOrderFieldLastSeenAt DeviceOrderField = "LAST_SEEN_AT"
+)
+
+var (
+	_ page.OrderField          = DeviceOrderField("")
+	_ fmt.Stringer             = DeviceOrderField("")
+	_ encoding.TextMarshaler   = DeviceOrderField("")
+	_ encoding.TextUnmarshaler = (*DeviceOrderField)(nil)
+)
+
+func DeviceOrderFields() []DeviceOrderField {
+	return []DeviceOrderField{
+		DeviceOrderFieldCreatedAt,
+		DeviceOrderFieldUpdatedAt,
+		DeviceOrderFieldHostname,
+		DeviceOrderFieldLastSeenAt,
+	}
+}
+
+func (v DeviceOrderField) IsValid() bool {
+	switch v {
+	case
+		DeviceOrderFieldCreatedAt,
+		DeviceOrderFieldUpdatedAt,
+		DeviceOrderFieldHostname,
+		DeviceOrderFieldLastSeenAt:
+		return true
+	}
+
+	return false
+}
+
+func (v DeviceOrderField) String() string {
+	return string(v)
+}
+
+func (v DeviceOrderField) MarshalText() ([]byte, error) {
+	return []byte(v.String()), nil
+}
+
+func (v *DeviceOrderField) UnmarshalText(text []byte) error {
+	val := DeviceOrderField(text)
+	if !val.IsValid() {
+		return fmt.Errorf("invalid DeviceOrderField value: %q", string(text))
+	}
+
+	*v = val
+
+	return nil
+}
+
+func (f DeviceOrderField) Column() string {
+	switch f {
+	case DeviceOrderFieldCreatedAt:
+		return "created_at"
+	case DeviceOrderFieldUpdatedAt:
+		return "updated_at"
+	case DeviceOrderFieldHostname:
+		return "COALESCE(hostname, '')"
+	case DeviceOrderFieldLastSeenAt:
+		return "COALESCE(last_seen_at, '0001-01-01T00:00:00Z'::timestamptz)"
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", f))
+}
--- a/pkg/coredata/device_order_field_test.go
+++ b/pkg/coredata/device_order_field_test.go
@@ -0,0 +1,53 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+package coredata_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"go.probo.inc/probo/pkg/coredata"
+)
+
+func TestDeviceOrderField_Column(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		field coredata.DeviceOrderField
+		want  string
+	}{
+		{field: coredata.DeviceOrderFieldCreatedAt, want: "created_at"},
+		{field: coredata.DeviceOrderFieldUpdatedAt, want: "updated_at"},
+		{field: coredata.DeviceOrderFieldHostname, want: "COALESCE(hostname, '')"},
+		{
+			field: coredata.DeviceOrderFieldLastSeenAt,
+			want:  "COALESCE(last_seen_at, '0001-01-01T00:00:00Z'::timestamptz)",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(string(tt.field), func(t *testing.T) {
+			t.Parallel()
+
+			assert.Equal(t, tt.want, tt.field.Column())
+		})
+	}
+}
--- a/pkg/coredata/device_platform.go
+++ b/pkg/coredata/device_platform.go
@@ -0,0 +1,82 @@
+// Copyright (c) 2025-2026 Probo Inc <hello@probo.com>.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+package coredata
+
+import (
+	"encoding"
+	"fmt"
+)
+
+type DevicePlatform string
+
+const (
+	DevicePlatformDarwin  DevicePlatform = "DARWIN"
+	DevicePlatformLinux   DevicePlatform = "LINUX"
+	DevicePlatformFreeBSD DevicePlatform = "FREEBSD"
+	DevicePlatformWindows DevicePlatform = "WINDOWS"
+)
+
+var (
+	_ fmt.Stringer             = DevicePlatform("")
+	_ encoding.TextMarshaler   = DevicePlatform("")
+	_ encoding.TextUnmarshaler = (*DevicePlatform)(nil)
+)
+
+func DevicePlatforms() []DevicePlatform {
+	return []DevicePlatform{
+		DevicePlatformDarwin,
+		DevicePlatformLinux,
+		DevicePlatformFreeBSD,
+		DevicePlatformWindows,
+	}
+}
+
+func (v DevicePlatform) IsValid() bool {
+	switch v {
+	case
+		DevicePlatformDarwin,
+		DevicePlatformLinux,
+		DevicePlatformFreeBSD,
+		DevicePlatformWindows:
+		return true
+	}
+
+	return false
+}
+
+func (v DevicePlatform) String() string {
+	return string(v)
+}
+
+func (v DevicePlatform) MarshalText() ([]byte, error) {
+	return []byte(v.String()), nil
+}
+
+func (v *DevicePlatform) UnmarshalText(text []byte) error {
+	val := DevicePlatform(text)
+	if !val.IsValid() {
+		return fmt.Errorf("invalid DevicePlatform value: %q", string(text))
+	}
+
+	*v = val
+
+	return nil
+}
--- a/pkg/coredata/device_posture.go
+++ b/pkg/coredata/device_posture.go
@@ -0,0 +1,248 @@
+// Copyright (c) 2025-2026 Probo Inc <hello@probo.com>.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type (
+	DevicePosture struct {
+		ID             gid.GID             `db:"id"`
+		TenantID       gid.TenantID        `db:"tenant_id"`
+		OrganizationID gid.GID             `db:"organization_id"`
+		DeviceID       gid.GID             `db:"device_id"`
+		CheckKey       string              `db:"check_key"`
+		Status         DevicePostureStatus `db:"status"`
+		Evidence       json.RawMessage     `db:"evidence"`
+		ObservedAt     time.Time           `db:"observed_at"`
+		CreatedAt      time.Time           `db:"created_at"`
+	}
+
+	DevicePostures []*DevicePosture
+)
+
+const (
+	devicePostureHistoryMaxLimit     = 100
+	devicePostureObservedAtClockSkew = 5 * time.Minute
+)
+
+func (p DevicePosture) CursorKey(orderBy DevicePostureOrderField) page.CursorKey {
+	switch orderBy {
+	case DevicePostureOrderFieldCheckKey:
+		return page.NewCursorKey(p.ID, p.CheckKey)
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
+}
+
+func (p DevicePosture) Insert(
+	ctx context.Context,
+	conn pg.Tx,
+	scope Scoper,
+) error {
+	evidence := p.Evidence
+	if len(evidence) == 0 {
+		evidence = emptyJSONObject
+	}
+
+	now := p.CreatedAt
+	if now.IsZero() {
+		now = time.Now()
+	}
+
+	observedAt := normalizeObservedAt(p.ObservedAt, now)
+
+	q := `
+INSERT INTO device_postures (
+    id,
+    tenant_id,
+    organization_id,
+    device_id,
+    check_key,
+    status,
+    evidence,
+    observed_at,
+    created_at
+) VALUES (
+    @id,
+    @tenant_id,
+    @organization_id,
+    @device_id,
+    @check_key,
+    @status,
+    @evidence,
+    @observed_at,
+    @created_at
+)
+`
+	args := pgx.StrictNamedArgs{
+		"id":              p.ID,
+		"tenant_id":       scope.GetTenantID(),
+		"organization_id": p.OrganizationID,
+		"device_id":       p.DeviceID,
+		"check_key":       p.CheckKey,
+		"status":          p.Status,
+		"evidence":        evidence,
+		"observed_at":     observedAt,
+		"created_at":      p.CreatedAt,
+	}
+
+	if _, err := conn.Exec(ctx, q, args); err != nil {
+		return fmt.Errorf("cannot insert device posture: %w", err)
+	}
+
+	return nil
+}
+
+// normalizeObservedAt bounds client-supplied observation times before
+// persistence. Zero timestamps default to now; values beyond the clock-skew
+// allowance are clamped to now so a far-future observed_at cannot remain the
+// latest result indefinitely.
+func normalizeObservedAt(observed, now time.Time) time.Time {
+	if observed.IsZero() {
+		return now
+	}
+
+	if observed.After(now.Add(devicePostureObservedAtClockSkew)) {
+		return now
+	}
+
+	return observed
+}
+
+// LoadLatestByDeviceID loads a page of the latest posture row for each
+// check_key on the given device.
+func (p *DevicePostures) LoadLatestByDeviceID(
+	ctx context.Context,
+	conn pg.Querier,
+	scope Scoper,
+	deviceID gid.GID,
+	cursor *page.Cursor[DevicePostureOrderField],
+) error {
+	q := `
+WITH latest AS (
+    SELECT DISTINCT ON (check_key)
+        id,
+        tenant_id,
+        organization_id,
+        device_id,
+        check_key,
+        status,
+        evidence,
+        observed_at,
+        created_at
+    FROM
+        device_postures
+    WHERE
+        %s
+        AND device_id = @device_id
+    ORDER BY check_key, observed_at DESC
+)
+SELECT * FROM latest WHERE %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"device_id": deviceID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query latest device postures: %w", err)
+	}
+
+	postures, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[DevicePosture])
+	if err != nil {
+		return fmt.Errorf("cannot collect device postures: %w", err)
+	}
+
+	*p = postures
+
+	return nil
+}
+
+// LoadHistoryByDeviceIDAndCheckKey returns the most recent N entries for one
+// (device, check_key) pair, newest first.
+func (p *DevicePostures) LoadHistoryByDeviceIDAndCheckKey(
+	ctx context.Context,
+	conn pg.Querier,
+	scope Scoper,
+	deviceID gid.GID,
+	checkKey string,
+	limit int,
+) error {
+	if limit <= 0 || limit > devicePostureHistoryMaxLimit {
+		limit = devicePostureHistoryMaxLimit
+	}
+
+	q := `
+SELECT
+    id,
+    tenant_id,
+    organization_id,
+    device_id,
+    check_key,
+    status,
+    evidence,
+    observed_at,
+    created_at
+FROM
+    device_postures
+WHERE
+    %s
+    AND device_id = @device_id
+    AND check_key = @check_key
+ORDER BY observed_at DESC
+LIMIT @limit
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"device_id": deviceID,
+		"check_key": checkKey,
+		"limit":     limit,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query device posture history: %w", err)
+	}
+
+	postures, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[DevicePosture])
+	if err != nil {
+		return fmt.Errorf("cannot collect device posture history: %w", err)
+	}
+
+	*p = postures
+
+	return nil
+}
--- a/pkg/coredata/device_posture_check_key.go
+++ b/pkg/coredata/device_posture_check_key.go
@@ -0,0 +1,100 @@
+// Copyright (c) 2025-2026 Probo Inc <hello@probo.com>.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+package coredata
+
+import (
+	"encoding"
+	"fmt"
+)
+
+// DevicePostureCheckKey is a string identifier for a single posture check.
+// New keys can be added freely without a database migration; the column is a
+// plain TEXT.
+type DevicePostureCheckKey string
+
+const (
+	DevicePostureCheckKeyDiskEncryption    DevicePostureCheckKey = "DISK_ENCRYPTION"
+	DevicePostureCheckKeyScreenLock        DevicePostureCheckKey = "SCREEN_LOCK"
+	DevicePostureCheckKeyFirewallEnabled   DevicePostureCheckKey = "FIREWALL_ENABLED"
+	DevicePostureCheckKeyTimeSync          DevicePostureCheckKey = "TIME_SYNC"
+	DevicePostureCheckKeyOSVersion         DevicePostureCheckKey = "OS_VERSION"
+	DevicePostureCheckKeyAutoUpdate        DevicePostureCheckKey = "AUTO_UPDATE"
+	DevicePostureCheckKeyPasswordPolicy    DevicePostureCheckKey = "PASSWORD_POLICY"
+	DevicePostureCheckKeyRemoteLogin       DevicePostureCheckKey = "REMOTE_LOGIN"
+	DevicePostureCheckKeyMalwareProtection DevicePostureCheckKey = "MALWARE_PROTECTION"
+)
+
+var (
+	_ fmt.Stringer             = DevicePostureCheckKey("")
+	_ encoding.TextMarshaler   = DevicePostureCheckKey("")
+	_ encoding.TextUnmarshaler = (*DevicePostureCheckKey)(nil)
+)
+
+func DevicePostureCheckKeys() []DevicePostureCheckKey {
+	return []DevicePostureCheckKey{
+		DevicePostureCheckKeyDiskEncryption,
+		DevicePostureCheckKeyScreenLock,
+		DevicePostureCheckKeyFirewallEnabled,
+		DevicePostureCheckKeyTimeSync,
+		DevicePostureCheckKeyOSVersion,
+		DevicePostureCheckKeyAutoUpdate,
+		DevicePostureCheckKeyPasswordPolicy,
+		DevicePostureCheckKeyRemoteLogin,
+		DevicePostureCheckKeyMalwareProtection,
+	}
+}
+
+func (v DevicePostureCheckKey) IsValid() bool {
+	switch v {
+	case
+		DevicePostureCheckKeyDiskEncryption,
+		DevicePostureCheckKeyScreenLock,
+		DevicePostureCheckKeyFirewallEnabled,
+		DevicePostureCheckKeyTimeSync,
+		DevicePostureCheckKeyOSVersion,
+		DevicePostureCheckKeyAutoUpdate,
+		DevicePostureCheckKeyPasswordPolicy,
+		DevicePostureCheckKeyRemoteLogin,
+		DevicePostureCheckKeyMalwareProtection:
+		return true
+	}
+
+	return false
+}
+
+func (v DevicePostureCheckKey) String() string {
+	return string(v)
+}
+
+func (v DevicePostureCheckKey) MarshalText() ([]byte, error) {
+	return []byte(v.String()), nil
+}
+
+func (v *DevicePostureCheckKey) UnmarshalText(text []byte) error {
+	val := DevicePostureCheckKey(text)
+	if !val.IsValid() {
+		return fmt.Errorf("invalid DevicePostureCheckKey value: %q", string(text))
+	}
+
+	*v = val
+
+	return nil
+}
--- a/pkg/coredata/device_posture_observed_at_test.go
+++ b/pkg/coredata/device_posture_observed_at_test.go
@@ -0,0 +1,80 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+package coredata
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestNormalizeObservedAt(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 7, 15, 10, 0, 0, 0, time.UTC)
+
+	tests := []struct {
+		name     string
+		observed time.Time
+		want     time.Time
+	}{
+		{
+			name:     "zero clamps to now",
+			observed: time.Time{},
+			want:     now,
+		},
+		{
+			name:     "past is unchanged",
+			observed: now.Add(-time.Hour),
+			want:     now.Add(-time.Hour),
+		},
+		{
+			name:     "slightly future within skew is unchanged",
+			observed: now.Add(2 * time.Minute),
+			want:     now.Add(2 * time.Minute),
+		},
+		{
+			name:     "far future beyond skew clamps to now",
+			observed: now.Add(time.Hour),
+			want:     now,
+		},
+		{
+			name:     "exactly at skew boundary is unchanged",
+			observed: now.Add(devicePostureObservedAtClockSkew),
+			want:     now.Add(devicePostureObservedAtClockSkew),
+		},
+		{
+			name:     "just beyond skew boundary clamps to now",
+			observed: now.Add(devicePostureObservedAtClockSkew + time.Nanosecond),
+			want:     now,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			got := normalizeObservedAt(tt.observed, now)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
--- a/pkg/coredata/device_posture_order_field.go
+++ b/pkg/coredata/device_posture_order_field.go
@@ -0,0 +1,84 @@
+// Copyright (c) 2025-2026 Probo Inc <hello@probo.com>.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+package coredata
+
+import (
+	"encoding"
+	"fmt"
+
+	"go.probo.inc/probo/pkg/page"
+)
+
+type DevicePostureOrderField string
+
+const (
+	DevicePostureOrderFieldCheckKey DevicePostureOrderField = "CHECK_KEY"
+)
+
+var (
+	_ page.OrderField          = DevicePostureOrderField("")
+	_ fmt.Stringer             = DevicePostureOrderField("")
+	_ encoding.TextMarshaler   = DevicePostureOrderField("")
+	_ encoding.TextUnmarshaler = (*DevicePostureOrderField)(nil)
+)
+
+func DevicePostureOrderFields() []DevicePostureOrderField {
+	return []DevicePostureOrderField{
+		DevicePostureOrderFieldCheckKey,
+	}
+}
+
+func (v DevicePostureOrderField) IsValid() bool {
+	switch v {
+	case DevicePostureOrderFieldCheckKey:
+		return true
+	}
+
+	return false
+}
+
+func (v DevicePostureOrderField) String() string {
+	return string(v)
+}
+
+func (v DevicePostureOrderField) MarshalText() ([]byte, error) {
+	return []byte(v.String()), nil
+}
+
+func (v *DevicePostureOrderField) UnmarshalText(text []byte) error {
+	val := DevicePostureOrderField(text)
+	if !val.IsValid() {
+		return fmt.Errorf("invalid DevicePostureOrderField value: %q", string(text))
+	}
+
+	*v = val
+
+	return nil
+}
+
+func (f DevicePostureOrderField) Column() string {
+	switch f {
+	case DevicePostureOrderFieldCheckKey:
+		return "check_key"
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", f))
+}
--- a/pkg/coredata/device_posture_status.go
+++ b/pkg/coredata/device_posture_status.go
@@ -0,0 +1,82 @@
+// Copyright (c) 2025-2026 Probo Inc <hello@probo.com>.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+package coredata
+
+import (
+	"encoding"
+	"fmt"
+)
+
+type DevicePostureStatus string
+
+const (
+	DevicePostureStatusPass          DevicePostureStatus = "PASS"
+	DevicePostureStatusFail          DevicePostureStatus = "FAIL"
+	DevicePostureStatusUnknown       DevicePostureStatus = "UNKNOWN"
+	DevicePostureStatusNotApplicable DevicePostureStatus = "NOT_APPLICABLE"
+)
+
+var (
+	_ fmt.Stringer             = DevicePostureStatus("")
+	_ encoding.TextMarshaler   = DevicePostureStatus("")
+	_ encoding.TextUnmarshaler = (*DevicePostureStatus)(nil)
+)
+
+func DevicePostureStatuses() []DevicePostureStatus {
+	return []DevicePostureStatus{
+		DevicePostureStatusPass,
+		DevicePostureStatusFail,
+		DevicePostureStatusUnknown,
+		DevicePostureStatusNotApplicable,
+	}
+}
+
+func (v DevicePostureStatus) IsValid() bool {
+	switch v {
+	case
+		DevicePostureStatusPass,
+		DevicePostureStatusFail,
+		DevicePostureStatusUnknown,
+		DevicePostureStatusNotApplicable:
+		return true
+	}
+
+	return false
+}
+
+func (v DevicePostureStatus) String() string {
+	return string(v)
+}
+
+func (v DevicePostureStatus) MarshalText() ([]byte, error) {
+	return []byte(v.String()), nil
+}
+
+func (v *DevicePostureStatus) UnmarshalText(text []byte) error {
+	val := DevicePostureStatus(text)
+	if !val.IsValid() {
+		return fmt.Errorf("invalid DevicePostureStatus value: %q", string(text))
+	}
+
+	*v = val
+
+	return nil
+}
--- a/pkg/coredata/device_posture_test.go
+++ b/pkg/coredata/device_posture_test.go
@@ -0,0 +1,210 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+package coredata_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/internal/test"
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type devicePostureFixture struct {
+	scope          *coredata.Scope
+	organizationID gid.GID
+	deviceID       gid.GID
+}
+
+func seedDevicePostureFixture(t *testing.T, ctx context.Context, client *pg.Client) devicePostureFixture {
+	t.Helper()
+
+	tenantID := gid.NewTenantID()
+	scope := coredata.NewScope(tenantID)
+	organizationID := gid.New(tenantID, coredata.OrganizationEntityType)
+	deviceID := gid.New(tenantID, coredata.DeviceEntityType)
+	now := time.Now().UTC().Truncate(time.Microsecond)
+
+	require.NoError(t, client.WithTx(ctx, func(ctx context.Context, tx pg.Tx) error {
+		org := &coredata.Organization{
+			ID:        organizationID,
+			TenantID:  tenantID,
+			Name:      "Device Posture Test Org",
+			CreatedAt: now,
+			UpdatedAt: now,
+		}
+		if err := org.Insert(ctx, tx); err != nil {
+			return err
+		}
+
+		device := coredata.Device{
+			ID:             deviceID,
+			OrganizationID: organizationID,
+			State:          coredata.DeviceStatePending,
+			APIKeyHash:     []byte("device-posture-test-" + deviceID.String()),
+			CreatedAt:      now,
+			UpdatedAt:      now,
+		}
+		if err := device.Insert(ctx, tx, scope); err != nil {
+			return err
+		}
+
+		return nil
+	}))
+
+	t.Cleanup(func() {
+		_ = client.WithTx(context.Background(), func(ctx context.Context, tx pg.Tx) error {
+			if _, err := tx.Exec(ctx, `DELETE FROM device_postures WHERE device_id = $1`, deviceID); err != nil {
+				return err
+			}
+
+			if _, err := tx.Exec(ctx, `DELETE FROM devices WHERE id = $1`, deviceID); err != nil {
+				return err
+			}
+
+			if _, err := tx.Exec(ctx, `DELETE FROM organizations WHERE id = $1`, organizationID); err != nil {
+				return err
+			}
+
+			return nil
+		})
+	})
+
+	return devicePostureFixture{
+		scope:          scope,
+		organizationID: organizationID,
+		deviceID:       deviceID,
+	}
+}
+
+func insertDevicePosture(
+	t *testing.T,
+	ctx context.Context,
+	client *pg.Client,
+	fx devicePostureFixture,
+	checkKey string,
+	status coredata.DevicePostureStatus,
+	observedAt time.Time,
+) {
+	t.Helper()
+
+	posture := coredata.DevicePosture{
+		ID:             gid.New(fx.scope.GetTenantID(), coredata.DevicePostureEntityType),
+		OrganizationID: fx.organizationID,
+		DeviceID:       fx.deviceID,
+		CheckKey:       checkKey,
+		Status:         status,
+		ObservedAt:     observedAt,
+		CreatedAt:      observedAt,
+	}
+
+	require.NoError(t, client.WithTx(ctx, func(ctx context.Context, tx pg.Tx) error {
+		return posture.Insert(ctx, tx, fx.scope)
+	}))
+}
+
+func TestDevicePosture_LoadLatestByDeviceID_ReturnsLatestPerCheckKey(t *testing.T) {
+	t.Parallel()
+
+	client := test.PGClient(t)
+	ctx := context.Background()
+	fx := seedDevicePostureFixture(t, ctx, client)
+
+	now := time.Now().UTC().Truncate(time.Microsecond)
+
+	insertDevicePosture(t, ctx, client, fx, "AUTO_UPDATE", coredata.DevicePostureStatusFail, now.Add(-2*time.Hour))
+	insertDevicePosture(t, ctx, client, fx, "AUTO_UPDATE", coredata.DevicePostureStatusPass, now.Add(-time.Hour))
+	insertDevicePosture(t, ctx, client, fx, "DISK_ENCRYPTION", coredata.DevicePostureStatusUnknown, now.Add(-30*time.Minute))
+	insertDevicePosture(t, ctx, client, fx, "FIREWALL_ENABLED", coredata.DevicePostureStatusFail, now.Add(-time.Minute))
+
+	var (
+		pageOne coredata.DevicePostures
+		hasNext bool
+	)
+
+	require.NoError(t, client.WithConn(ctx, func(ctx context.Context, conn pg.Querier) error {
+		orderBy := page.OrderBy[coredata.DevicePostureOrderField]{
+			Field:     coredata.DevicePostureOrderFieldCheckKey,
+			Direction: page.OrderDirectionAsc,
+		}
+		cursor := page.NewCursor(2, nil, page.Head, orderBy)
+
+		var batch coredata.DevicePostures
+		if err := batch.LoadLatestByDeviceID(ctx, conn, fx.scope, fx.deviceID, cursor); err != nil {
+			return err
+		}
+
+		p := page.NewPage(batch, cursor)
+		pageOne = p.Data
+		hasNext = p.Info.HasNext
+
+		return nil
+	}))
+	require.Len(t, pageOne, 2)
+	require.True(t, hasNext)
+	assert.Equal(t, "AUTO_UPDATE", pageOne[0].CheckKey)
+	assert.Equal(t, coredata.DevicePostureStatusPass, pageOne[0].Status)
+	assert.Equal(t, "DISK_ENCRYPTION", pageOne[1].CheckKey)
+
+	var all coredata.DevicePostures
+
+	require.NoError(t, client.WithConn(ctx, func(ctx context.Context, conn pg.Querier) error {
+		loaded, err := page.LoadAll(
+			ctx,
+			page.OrderBy[coredata.DevicePostureOrderField]{
+				Field:     coredata.DevicePostureOrderFieldCheckKey,
+				Direction: page.OrderDirectionAsc,
+			},
+			func(ctx context.Context, cursor *page.Cursor[coredata.DevicePostureOrderField]) ([]*coredata.DevicePosture, error) {
+				var batch coredata.DevicePostures
+				if err := batch.LoadLatestByDeviceID(ctx, conn, fx.scope, fx.deviceID, cursor); err != nil {
+					return nil, fmt.Errorf("cannot load latest device postures: %w", err)
+				}
+
+				return batch, nil
+			},
+		)
+		if err != nil {
+			return err
+		}
+
+		all = loaded
+
+		return nil
+	}))
+	require.Len(t, all, 3)
+
+	byKey := make(map[string]coredata.DevicePostureStatus, len(all))
+	for _, posture := range all {
+		byKey[posture.CheckKey] = posture.Status
+	}
+
+	assert.Equal(t, coredata.DevicePostureStatusPass, byKey["AUTO_UPDATE"])
+	assert.Equal(t, coredata.DevicePostureStatusUnknown, byKey["DISK_ENCRYPTION"])
+	assert.Equal(t, coredata.DevicePostureStatusFail, byKey["FIREWALL_ENABLED"])
+}
--- a/pkg/coredata/device_state.go
+++ b/pkg/coredata/device_state.go
@@ -0,0 +1,79 @@
+// Copyright (c) 2025-2026 Probo Inc <hello@probo.com>.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+package coredata
+
+import (
+	"encoding"
+	"fmt"
+)
+
+type DeviceState string
+
+const (
+	DeviceStatePending DeviceState = "PENDING"
+	DeviceStateActive  DeviceState = "ACTIVE"
+	DeviceStateRevoked DeviceState = "REVOKED"
+)
+
+var (
+	_ fmt.Stringer             = DeviceState("")
+	_ encoding.TextMarshaler   = DeviceState("")
+	_ encoding.TextUnmarshaler = (*DeviceState)(nil)
+)
+
+func DeviceStates() []DeviceState {
+	return []DeviceState{
+		DeviceStatePending,
+		DeviceStateActive,
+		DeviceStateRevoked,
+	}
+}
+
+func (v DeviceState) IsValid() bool {
+	switch v {
+	case
+		DeviceStatePending,
+		DeviceStateActive,
+		DeviceStateRevoked:
+		return true
+	}
+
+	return false
+}
+
+func (v DeviceState) String() string {
+	return string(v)
+}
+
+func (v DeviceState) MarshalText() ([]byte, error) {
+	return []byte(v.String()), nil
+}
+
+func (v *DeviceState) UnmarshalText(text []byte) error {
+	val := DeviceState(text)
+	if !val.IsValid() {
+		return fmt.Errorf("invalid DeviceState value: %q", string(text))
+	}
+
+	*v = val
+
+	return nil
+}
--- a/pkg/coredata/entity_type_reg.go
+++ b/pkg/coredata/entity_type_reg.go
@@ -136,6 +136,9 @@ const (
 	CompliancePortalCommitmentGroupEntityType        uint16 = 104
 	CompliancePortalCommitmentEntityType             uint16 = 105
 	CertificateEntityType                            uint16 = 106
+	DeviceEntityType                                 uint16 = 107
+	DevicePostureEntityType                          uint16 = 108
+	DeviceEnrollmentTokenEntityType                  uint16 = 109
 )

 func NewEntityFromID(id gid.GID) (any, bool) {
@@ -336,6 +339,12 @@ func NewEntityFromID(id gid.GID) (any, bool) {
 		return &CompliancePortalCommitment{ID: id}, true
 	case CertificateEntityType:
 		return &Certificate{ID: id}, true
+	case DeviceEntityType:
+		return &Device{ID: id}, true
+	case DevicePostureEntityType:
+		return &DevicePosture{ID: id}, true
+	case DeviceEnrollmentTokenEntityType:
+		return &DeviceEnrollmentToken{ID: id}, true
 	default:
 		return nil, false
 	}
--- a/pkg/coredata/migrations/20260710T120000Z.sql
+++ b/pkg/coredata/migrations/20260710T120000Z.sql
@@ -0,0 +1,106 @@
+-- Copyright (c) 2026 Probo Inc <hello@probo.com>.
+--
+-- Permission is hereby granted, free of charge, to any person obtaining a copy
+-- of this software and associated documentation files (the "Software"), to deal
+-- in the Software without restriction, including without limitation the rights
+-- to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+-- copies of the Software, and to permit persons to whom the Software is
+-- furnished to do so, subject to the following conditions:
+--
+-- The above copyright notice and this permission notice shall be included in
+-- all copies or substantial portions of the Software.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+-- IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+-- FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+-- AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+-- LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+-- OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+-- SOFTWARE.
+
+CREATE TYPE device_platform AS ENUM (
+    'DARWIN',
+    'LINUX',
+    'FREEBSD',
+    'WINDOWS'
+);
+
+CREATE TYPE device_posture_status AS ENUM (
+    'PASS',
+    'FAIL',
+    'UNKNOWN',
+    'NOT_APPLICABLE'
+);
+
+CREATE TYPE device_state AS ENUM (
+    'PENDING',
+    'ACTIVE',
+    'REVOKED'
+);
+
+CREATE TABLE devices (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    organization_id TEXT NOT NULL REFERENCES organizations(id) ON UPDATE CASCADE ON DELETE CASCADE,
+    state device_state NOT NULL DEFAULT 'PENDING',
+    hardware_uuid TEXT,
+    serial_number TEXT,
+    hostname TEXT,
+    platform device_platform,
+    os_version TEXT,
+    agent_version TEXT,
+    api_key_hash BYTEA NOT NULL,
+    owner_profile_id TEXT REFERENCES iam_membership_profiles(id) ON UPDATE CASCADE ON DELETE RESTRICT,
+    labels JSONB NOT NULL DEFAULT '{}'::jsonb,
+    enrolled_at TIMESTAMP WITH TIME ZONE,
+    last_seen_at TIMESTAMP WITH TIME ZONE,
+    revoked_at TIMESTAMP WITH TIME ZONE,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    CONSTRAINT devices_active_fields_check CHECK (
+        state != 'ACTIVE'
+        OR (
+            hardware_uuid IS NOT NULL
+            AND hostname IS NOT NULL
+            AND platform IS NOT NULL
+            AND os_version IS NOT NULL
+            AND agent_version IS NOT NULL
+            AND enrolled_at IS NOT NULL
+            AND last_seen_at IS NOT NULL
+        )
+    ),
+    CONSTRAINT devices_revoked_at_check CHECK (
+        (state = 'REVOKED' AND revoked_at IS NOT NULL)
+        OR (state != 'REVOKED' AND revoked_at IS NULL)
+    )
+);
+
+CREATE UNIQUE INDEX devices_org_hardware_uuid_idx
+    ON devices (organization_id, hardware_uuid)
+    WHERE hardware_uuid IS NOT NULL
+      AND state != 'REVOKED';
+
+CREATE UNIQUE INDEX devices_api_key_hash_idx
+    ON devices (api_key_hash);
+
+CREATE INDEX devices_owner_profile_idx
+    ON devices (owner_profile_id)
+    WHERE owner_profile_id IS NOT NULL;
+
+CREATE TABLE device_postures (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    organization_id TEXT NOT NULL REFERENCES organizations(id) ON UPDATE CASCADE ON DELETE CASCADE,
+    device_id TEXT NOT NULL REFERENCES devices(id) ON UPDATE CASCADE ON DELETE CASCADE,
+    check_key TEXT NOT NULL,
+    status device_posture_status NOT NULL,
+    evidence JSONB NOT NULL DEFAULT '{}'::jsonb,
+    observed_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL
+);
+
+CREATE INDEX device_postures_device_id_check_key_observed_at_idx
+    ON device_postures (device_id, check_key, observed_at DESC);
+
+CREATE INDEX device_postures_organization_id_idx
+    ON device_postures (organization_id);
--- a/pkg/coredata/migrations/20260711T094136Z.sql
+++ b/pkg/coredata/migrations/20260711T094136Z.sql
@@ -0,0 +1,41 @@
+-- Copyright (c) 2026 Probo Inc <hello@probo.com>.
+--
+-- Permission is hereby granted, free of charge, to any person obtaining a copy
+-- of this software and associated documentation files (the "Software"), to deal
+-- in the Software without restriction, including without limitation the rights
+-- to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+-- copies of the Software, and to permit persons to whom the Software is
+-- furnished to do so, subject to the following conditions:
+--
+-- The above copyright notice and this permission notice shall be included in
+-- all copies or substantial portions of the Software.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+-- IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+-- FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+-- AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+-- LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+-- OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+-- SOFTWARE.
+
+CREATE TABLE device_enrollment_tokens (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    device_id TEXT NOT NULL REFERENCES devices(id) ON UPDATE CASCADE ON DELETE CASCADE,
+    hashed_value BYTEA NOT NULL,
+    expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    CONSTRAINT device_enrollment_tokens_hashed_value_unique UNIQUE (hashed_value)
+);
+
+CREATE INDEX device_enrollment_tokens_device_id_idx
+    ON device_enrollment_tokens (device_id);
+
+ALTER TABLE devices
+    ALTER COLUMN api_key_hash DROP NOT NULL;
+
+ALTER TABLE devices
+    ADD CONSTRAINT devices_active_api_key_hash_check CHECK (
+        state != 'ACTIVE'
+        OR api_key_hash IS NOT NULL
+    );