I think it would be very useful to have a way to define tasks that always run at the very beginning of a session, before any other actions are evaluated. In our case, we need to set up a brief firewall authorization so the device can reach certain deployment resources. Right now, that setup check runs at the same stage as our deauth check, which means the deauth part always evaluates as compliant because the auth hasn’t been created yet. Having a dedicated pre-session step would avoid that entirely.
It would also be really helpful to have tasks that always run at the very end of a session. That would let us reliably remove the temporary firewall access and run some general cleanup actions that depend on the session’s final state.
In short, dedicated places for setup and cleanup outside the normal evaluation flow would make these workflows much easier to manage, especially when actions need to happen before or after everything else.
If something like this already exists and I’ve just missed it, feel free to point me in the right direction. Otherwise, I think this capability would be genuinely helpful in a lot of deployment scenarios.
Thanks for reading, and happy to clarify anything if needed.