Add branded default provider and enforced enrollment

docs/architecture.md

@@ -61,6 +61,13 @@ still contain the Unicode replacement character are not written to AD.
 When `RemoteDesktopGroupDn` is configured, the broker also adds each successfully
 synchronized SGU user to that dedicated AD security group. The laboratory
 Windows client maps the group into its local **Remote Desktop Users** group.
+Every synchronized user also receives `Universidad La Salle` in the AD
+`company` attribute unless deployment configuration supplies another default.
+
+The generic SGU credential is rendered as a dedicated branded tile instead of
+being grouped below the anonymous **Other user** tile. Machine policy assigns
+the SGU CLSID as the default provider while retaining the built-in Microsoft
+password provider.
 
 The managed hierarchy is rooted at `OU=Usuarios-SGU`: `Docentes`, `Alumnos`,
 and `Administrativos` are direct child OUs beneath it.