> ## Documentation Index
> Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL.
> Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other.
> Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking.
> Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify.

# Manage PCR Templates

> Add, edit, and delete PCR attestation templates on hardware models in My Library to validate EVE-OS device boot integrity during remote attestation.

Platform Configuration Registers (PCRs) are tamper-evident registers inside a device's Trusted Platform Module (TPM) that record measurements of firmware, bootloader, and OS components as they load during startup. Each register holds a hash value representing the state of a specific layer of the boot chain. If any component is modified, the corresponding PCR value changes.

A PCR template is a named set of expected PCR values that you associate with a hardware model. During remote attestation (the process by which Edge Infrastructure Services verifies a device's boot integrity before trusting it), EVE-OS (Edge Virtualization Engine) reads the live PCR values from the device TPM and compares them against the template. If the values match, attestation succeeds and the node is trusted. If they do not match, Edge Infrastructure Services flags the device as untrusted.

PCR templates are attached to hardware models in your enterprise library. ZEDEDA-managed catalog models do not support PCR templates directly; you must first import the model into your library.

## Prerequisites

* Your enterprise must have at least one hardware model in My Library (origin: Imported or Local).
* You have the SysManager or SysAdmin role in your enterprise. See [Manage Roles](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-roles.md). Users without this role can view templates but cannot make changes.
* To obtain expected PCR values, boot a known-good reference device and retrieve the values from the TPM using your standard tooling.

## View PCR Templates

1. In the sidebar, select **Marketplace**.
2. Select **My Library**.
3. Select the **Hardware** filter tab.
4. Select a hardware model to open its detail page.
5. Select the **Attestation** tab.

The **PCR Templates** tab header shows a count badge with the number of templates configured for the hardware model. The table lists each template with the following columns:

| Column | Description |
| - | - |
| **Name** | The name assigned to the template. |
| **EVE Version** | The EVE-OS image version the template applies to. |
| **Firmware Version** | The firmware version the template applies to (if specified). |

Use the gear icon in the table row to edit a template, and the trash icon to delete it.

If no templates have been configured, the tab displays: "No PCR templates configured — Add a PCR template to configure model attestation values."

## Add a PCR Template

1. Navigate to the **Attestation** tab of a hardware model in My Library.

2. Select **Add Template**.

3. Complete the fields in the dialog:

   | Field | Description |
   | - | - |
   | **Name** | A descriptive name for the template. Required. |
   | **EVE-OS Image Version** | The EVE-OS release this template applies to. Select a version from the dropdown. Required. |
   | **Firmware Version** | The firmware version of the reference device. Optional. |

4. In the **PCR Values** table, enter the expected hash value for each PCR index you want to validate. The table contains 24 rows (Index 0 through 23). Leave a row empty to skip validation for that index.

   > [!TIP]
   >
   > For a reference of what each PCR index measures and the security implications of a mismatch, see [TPM PCR Index Security Implications](https://zededa.mintlify.site/new-ui/infrastructure-services/eve-os/tpm-pcr-security.md).

5. Select **Save**.

The new template appears in the PCR Templates table and is immediately active for attestation checks on nodes using this hardware model. You can also reach this form prepopulated from a node. See [Node Details](https://zededa.mintlify.site/new-ui/infrastructure-services/nodes/node-details.md#system-and-security-panel).

## Edit a PCR Template

1. Navigate to the **Attestation** tab of a hardware model in My Library.
2. In the PCR Templates table, select the gear icon for the template you want to edit.
3. Update the **Name**, **EVE-OS Image Version**, **Firmware Version**, or any PCR values.
4. Select **Save**.

Changes take effect for subsequent attestation checks.

## Delete a PCR Template

1. Navigate to the **Attestation** tab of a hardware model in My Library.
2. In the PCR Templates table, select the trash icon for the template you want to remove.
3. In the confirmation dialog, select **Delete**.

Deleting a PCR template removes it permanently. Nodes that were previously validated against the template will require a new matching template to pass attestation on their next check.

## Next Steps

> [card] [Remote Attestation](https://zededa.mintlify.site/new-ui/infrastructure-services/eve-os/remote-attestation.md)
>
> Learn how Edge Infrastructure Services uses PCR templates to verify device integrity at runtime.

> [card] [Hardware Models](https://zededa.mintlify.site/new-ui/marketplace/hardware-models.md)
>
> Browse the hardware catalog and import models into your enterprise library.

> [card] [Flexible PCR Policy](https://zededa.mintlify.site/new-ui/infrastructure-services/eve-os/flexible-pcr-policy.md)
>
> Customize which PCR indexes EVE-OS uses to seal the vault encryption key into the TPM — a related but separate concept from attestation templates.

> [card] [TPM PCR Index Security Implications](https://zededa.mintlify.site/new-ui/infrastructure-services/eve-os/tpm-pcr-security.md)
>
> Reference table of all PCR indexes, their usage in EVE-OS, and the security implications of each.