It comes down to checking the endpoints with a client to see...

It comes down to checking the endpoints with a client to see if they are compliant with a policy that says they are safe to be admitted to the network.