Choose which agent to authorize and define the bounds of its authority. These constraints are encoded into the CAPP grant and stored in the permission ledger.
Agent weight 1 < threshold 3. Agent cannot sign deploys alone. Secure.