"device approval is <n>" — a new-sign-in card with device rows and Approve/Deny; the visual only, wire it to your own session security.