Allow for provisioners to fire (or more accurately provide non-empty information) only for select sub-populations, probably based on COU/Role Affiliation/Group membership. This would probably be implemented by removing the non-matching roles and only passing through the record if at least one role matched.

Configuration probably via cm_co_provisioning_targets.