Use the client action IsRootedDevice to check whether the device is rooted (Android) or jailbroken (iOS).
You can then add custom logic to block access, show a warning message, log the event, or restrict sensitive features when the device is detected as insecure.