Agents for controlplane-agent (mTLS sync)
Create an agent, issue a one-time enrollment token, then enroll on the host. Grant policies in Policies.