Certificate policies and client grants for agent sync
Define allowed actions and DNS scope, then grant policies to agents in Agents.