Certificate policies and agent grants for sync
Define allowed actions and DNS scope, then grant policies to agent groups in Agent groups.