Whitelist-based device access: only devices whose MAC ID is pre-registered in the system can install and use the app. Admin console to add/remove MAC IDs, view active devices per user, force-logout, and push remote config.