Native uses the same consent API
iOS and Android AuthGate call POST /api/v1/guardian/consent. Same 8+ rule. No session is minted.
iOS GuardianConsentFlow and Android AuthGate guardian call POST /api/v1/guardian/consent after the code is pasted. They do not mint a Keychain or EncryptedPrefs session from this POST.
GET /api/v1/guardian/consent?q= lists these topics in-app. Impersonation stays web-only.