## TL;DR
Serial numbers and asset tags live in different fields and can collide as strings, so search the exact field and confirm a second identifier. Query by serial number explicitly, show the asset tag and assigned user for confirmation, and require both to agree before wipe, lock, or push.

## Steps
1. Change device lookup to query the serial number field specifically, not a free-text search.
   Expected: Results match on serial only.
2. Display the returned device's serial, asset tag, and assigned user together.
   Expected: The operator or agent sees all three identifiers.
3. Require the ticket's expected user or asset tag to match the returned record before acting.
   Expected: Mismatches abort the action.
4. Log all three identifiers with every remote command.
   Expected: The audit names the exact device targeted.

## When to use
- The agent sends remote lock, wipe, or push commands via Jamf
- Asset tags and serials are both used as lookup keys
- A command once hit the wrong machine

## When not to use
- Lookups are by Jamf's internal id from a prior verified step
- The agent only reads inventory, never acts
- A human confirms the device before each command

## Why this happens
Free-text device search matches across serial, asset tag, hostname, and username, so a short asset tag can easily match part of a serial number. Remote actions do not ask twice, which turns a search ambiguity into a wipe of the wrong laptop.

## Edge cases
- Reimaged machines can carry a new serial in Jamf while the asset tag stays, splitting the identity.
- Barcodes scanned from stickers sometimes include prefix characters that break exact matching.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_0L5Ml_07DiPGydHl63wzPA