the managed-device API works if it is exposed
The call either rejects with a genuine named exception (ordinary on an unmanaged device) or resolves with a genuine configuration object (ordinary on a managed one). Which of the two happens is reported, never scored.
What a detector infers
A deployed commercial agent devotes a whole signal to the managed-device interface, and how it handles the answer is more interesting than the answer.
It calls getManagedConfiguration with a throwaway key, catches the rejection, hashes the ERROR MESSAGE, and looks that hash up in a table of seven known values — then hides the index it matched, a number from zero to six, inside a sixteen-byte buffer filled from the cryptographic random generator and punctuated with dashes so that what appears on the wire is indistinguishable from a random session identifier. Two lessons come out of that.
The rejection state of this one API is being read as a seven-way oracle, and a field that looks like an opaque identifier is not necessarily one — which is worth remembering when auditing what a payload appears to contain. This row deliberately does NOT score the state, and the limit comes from measurement rather than caution: on an ordinary consumer Chrome the interface IS present — it is not gated on enterprise enrollment the way its name suggests — and the call rejects.
On a genuinely managed device it resolves instead. Scoring either direction would convict one of two entirely legitimate populations, and which one would depend only on how the row was phrased. What is safe is the presence-versus-behaviour argument this audit already applies to the origin private file system: an interface that is exposed has to be real.
A rejection must carry an actual named exception and a resolution must carry an actual object, because both a managed and an unmanaged browser satisfy that, while an interface bolted onto navigator with nothing behind it does not.
How to resolve it
If this surface is being shimmed to resemble a particular kind of device, it has to behave like the real one rather than merely exist. Using an API is the cheapest way to separate a stub from an implementation, and this one is already called deliberately in the field for exactly the state its rejection reveals.
Nearby checks in Navigator identity
- the user agent on the wire and the one JavaScript reports describe the same browser
ua-wire-vs-navigatorYour user agent is asserted on two channels built by different layers: the network stack writes the header, and the renderer answers… - a Date's own text agrees with the Date's own offset
date-tostring-coherenceA Date's text is not opaque. ECMA-262 defines toString() as toDateString() + " " + toTimeString(), fixes the weekday and month tables to… - Origin-scoped storage and browsing state
origin-storage-historyCookies, storage, IndexedDB, and same-tab history reveal only this origin's state. - Profile age and cross-site history boundary
profile-age-boundaryPrivacy boundaries prevent reading global history or true profile age. - Account reputation boundary
account-reputation-boundaryAccount reputation needs authentication and server history, neither of which this public audit has. - a build branded Google Chrome can encode the AAC that Google licenses
webcodecs-aac-vs-chrome-brandingThis is the licensed-codec argument asked at a second layer. - the content-protection modules present belong to the platform being claimed
drm-key-systems-vs-claimed-osA deployed commercial agent probes six content-protection families and ships one bit for each — Widevine twice, once with a stricter… - the fields a real identity matcher keys on are reported together
blocking-key-plausibilityMeasured against a deployed identity matcher, only a handful of fields broke an identity match when changed on their own: colour depth…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Navigator identity checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Navigator identity — the family managed-config-surface-behaviour belongs to.