I don't know more than what's mentioned in public sources, but I can guess: 1) BYOD is likely supported, but provisioning installs the invasive device monitor

I don't know more than what's mentioned in public sources, but I can guess: 1) BYOD is likely supported, but provisioning installs the invasive device monitor (as chrome extension [0]) 2) Paper mentions that you can at least install your own printers. I would think that SW engineers would have full access, subject to device monitor being happy. 3) Since all keys (both per-user and per-device) are stored centrally, it should be fairly easy to revoke all device keys in this case. [0] https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/46366.pdf https://static.googleusercontent.com/media/research.google.c...