the metrics from the host include a hostname/host_uuid, some sort of asset identification and the user who is authenticated to the machine, log those details and store them into some DB. Then when someone goes to make a login action, go lookup the details and use their device state to help make the auth decision, right?