A device comprising: one or more processors; a payload interface executable by the one or more processors to receive a payload containing a sealed container, one or more provisioning code segments outside the sealed container, and one or more policies located outside the sealed container, the one or more policies being based on the one or more provisioning code segments and corresponding to the sealed container; and a trusted computing manager executable by the one or more processors to: generate one or more measurements of the one or more provisioning code segments according to the one or more policies, to determine whether the generated one or more measurements satisfy the one or more policies based on the one or more measurements and an output of execution of the one or more provisioning code segments, wherein the execution of the one or more provisioning code segments located outside the sealed container by the device generates the output; and unseal, at a trusted platform module of the trusted computing manager, the sealed container responsive to determining that the generated one or more measurements and the output of the execution satisfy the one or more policies received in the payload, satisfaction of the one or more policies confirming integrity of the device. one or more processors; a payload interface executable by the one or more processors to receive a payload containing a sealed container, one or more provisioning code segments outside the sealed container, and one or more policies located outside the sealed container, the one or more policies being based on the one or more provisioning code segments and corresponding to the sealed container; and a trusted computing manager executable by the one or more processors to: generate one or more measurements of the one or more provisioning code segments according to the one or more policies, to determine whether the generated one or more measurements satisfy the one or more policies based on the one or more measurements and an output of execution of the one or more provisioning code segments, wherein the execution of the one or more provisioning code segments located outside the sealed container by the device generates the output; and unseal, at a trusted platform module of the trusted computing manager, the sealed container responsive to determining that the generated one or more measurements and the output of the execution satisfy the one or more policies received in the payload, satisfaction of the one or more policies confirming integrity of the device. generate one or more measurements of the one or more provisioning code segments according to the one or more policies, to determine whether the generated one or more measurements satisfy the one or more policies based on the one or more measurements and an output of execution of the one or more provisioning code segments, wherein the execution of the one or more provisioning code segments located outside the sealed container by the device generates the output; and unseal, at a trusted platform module of the trusted computing manager, the sealed container responsive to determining that the generated one or more measurements and the output of the execution satisfy the one or more policies received in the payload, satisfaction of the one or more policies confirming integrity of the device.