What I mean is that the enroll just be accessed by osqueryd when it start and the osqueryd will never access the enroll when it has enrolled successfully.Is that true? @groob

yes. after enrollment the server returns a unique “node key” for each device, and the node key is what is used