Hello Rob
what you mean is athaticatihan before booting. The concept is easy booting from local net via option 66,150 DHCP and TFTP. Than autentificate the User and the Client with a very small Linux or direct in Grub2. If the user is known and the client to (Password or smardcard fingerprint … ) starting a crossboot. Idea an some parts a coming form Coreboot and Qemu. With Crossboot strating the ClientOS.