# Deploy (advanced)

WarpStream BYOC Agents support a number of advanced features:

1. [Agent Roles](https://docs.warpstream.com/warpstream/kafka/advanced-agent-deployment-options/splitting-agent-roles) can be used to split an Agent deployment into multiple where each split handles a subset of the functionality. This is helpful for isolating the write path, read path, and background jobs from each other.
2. [Agent Groups](https://docs.warpstream.com/warpstream/kafka/advanced-agent-deployment-options/agent-groups) can be used to split a single logical WarpStream cluster at the service discovery level for isolation purposes, or so it can be flexed across multiple network boundaries (VPCs, cloud accounts, etc).
3. Agents can be configured with [TLS, mTLS, and SASL authentication](https://github.com/warpstreamlabs/docs/blob/master/kafka/advanced-agent-deployment-options/broken-reference/README.md).
4. Agents can be configured to have [much lower latency](https://docs.warpstream.com/warpstream/kafka/advanced-agent-deployment-options/low-latency-clusters) in exchange for higher costs.
5. Agents can be [deployed behind a standard proxy / network load balancer](https://docs.warpstream.com/warpstream/kafka/advanced-agent-deployment-options/configure-warpstream-agent-within-a-container-or-behind-a-proxy) because they're completely stateless and any Agent can serve requests for any topic-partition.