first commit

apps/browser/policy-assignment.cjs

@@ -0,0 +1,10 @@
+'use strict';
+// Check the signed effective policy before any enrollment state or browser
+// settings are committed. A valid fleet signature alone is not device binding.
+function assertPolicyAssignment(policy, deviceId) {
+  if (policy.assignment && policy.assignment.deviceId !== deviceId) {
+    throw Error('Policy device assignment rejected');
+  }
+  return policy;
+}
+module.exports = {assertPolicyAssignment};