# Mobile device trust checklist
- Name the protected server action and attacker-controlled inputs.
- Validate platform evidence through vendor-specific server verification.
- Bind proof to action and expected application identity.
- Enforce challenge freshness/replay semantics appropriate to the API mode.
- Authenticate the principal independently of device evidence.
- Authorize this principal's action on this resource.
- Apply a risk-specific outage policy and preserve observability.

Sources:
https://developer.apple.com/documentation/devicecheck/validating-apps-that-connect-to-your-server
https://developer.android.com/google/play/integrity/overview