A story of enterprise profiles, immutable company IDs, and BYOD made simple
Your personal key is yours: you can delete it, disable it, switch it out whenever you want. But your work keycard belongs to your company. They decide when to deactivate it, you can't delete it, and it might even have priority over your personal keys. Both live on the same keychain!
Any key becomes an enterprise key through its Enterprise Configuration: a globally unique Company OID (immutable forever!), a human-readable name, and three rule switches. The OID is written in hardware: even a rogue IT admin can't change it. Plus a quota on how many personal keys can be active!
Three rule switches give the company control: the Master Switch (this profile governs the whole vault: only ONE key can have this), Priority (work key comes first), and Enterprise-Only (no personal keys at all!). Plus a quota limits how many personal keys can be active alongside the work key.
Enterprise profiles combine PPRs (sticky notes like "can't delete") with Enterprise Rules (vault-wide control like "work-only device"). Both are enforced independently in vault hardware. Seven validation checks run during download: each with its own error code, so everyone knows exactly why something was rejected!
BYOD (Bring Your Own Device): you own the phone, the company provides the SIM: work key always active, personal keys limited by quota. COPE (Corporate Owned, Personally Enabled): company buys the phone, both work and personal keys coexist: work key undeletable, perhaps exactly one personal key allowed. Simple, secure coexistence!
Once an Enterprise OID is written into the vault, it can NEVER be changed: not by you, not by the company, not even by the Key Maker. The eUICC chip enforces this in hardware. Even a rogue IT admin can't remotely change the company ID on your work profile. The vault says: "Sorry, that field is locked forever!"