I'm going through certification bugs and trying to figure out how to solve this one. As far as I can tell, login and entitlement checks all work successfully (with no errors). Is there some hidden information somewhere describing how to enforce this?