A device comprising: a device interface configured to facilitate assignment of the device to a virtual machine, VM, managed by a hypervisor of a computing platform coupled to the device by a computer bus, access of the device by the VM, or removal of the device from being assigned to the VM; wherein the device interface includes logic in support of a device management protocol and configured to: place the device interface in an unlocked state as a default state of the device, a locked state to prevent changes to be made to the device interface, an operational state to enable access to device registers of the device by the VM or direct memory access, DMA, from the device to memory address spaces of the VM, or an error state to indicate an error has happened; characterized in that the logic in support of a device management protocol is further configured to: report configuration of the device interface to the VM, when in the locked state, and further reject untrusted access to register state of the device, when in the locked state; move the device interface into the operational state from the locked state, when the device is assigned to the VM and further authorized by a security credential provided by the VM; and move the device interface into the unlocked state when removing the device interface from being assigned to the VM, or when an error condition is detected that compromises the interface assignment, stop access by the VM to the device registers of the device and DMA by the device to memory spaces of the VM. a device interface configured to facilitate assignment of the device to a virtual machine, VM, managed by a hypervisor of a computing platform coupled to the device by a computer bus, access of the device by the VM, or removal of the device from being assigned to the VM; wherein the device interface includes logic in support of a device management protocol and configured to: place the device interface in an unlocked state as a default state of the device, a locked state to prevent changes to be made to the device interface, an operational state to enable access to device registers of the device by the VM or direct memory access, DMA, from the device to memory address spaces of the VM, or an error state to indicate an error has happened; an unlocked state as a default state of the device, a locked state to prevent changes to be made to the device interface, an operational state to enable access to device registers of the device by the VM or direct memory access, DMA, from the device to memory address spaces of the VM, or an error state to indicate an error has happened; characterized in that the logic in support of a device management protocol is further configured to: report configuration of the device interface to the VM, when in the locked state, and further reject untrusted access to register state of the device, when in the locked state; move the device interface into the operational state from the locked state, when the device is assigned to the VM and further authorized by a security credential provided by the VM; and move the device interface into the unlocked state when removing the device interface from being assigned to the VM, or when an error condition is detected that compromises the interface assignment, stop access by the VM to the device registers of the device and DMA by the device to memory spaces of the VM. report configuration of the device interface to the VM, when in the locked state, and further reject untrusted access to register state of the device, when in the locked state; move the device interface into the operational state from the locked state, when the device is assigned to the VM and further authorized by a security credential provided by the VM; and move the device interface into the unlocked state when removing the device interface from being assigned to the VM, or when an error condition is detected that compromises the interface assignment, stop access by the VM to the device registers of the device and DMA by the device to memory spaces of the VM.