How are app-publisher policies connected to device-side verification?

Short answer

App-publisher policies define which verifications are required, which attributes may be requested and how results map to access decisions. Device-side security applications produce evidence; publishers configure acceptance policy server-side. SDK post-login verification patterns illustrate this split. Exact policy engines remain product-documented.