Certificate policies and agent grants for sync
Define allowed actions and DNS scope, then grant policies to agents in Agents.