A TLOC route represents a WAN link that serves as a tunnel endpoint and is uniquely identified by {System-IP, Color, Encapsulation}. Note that the System IP address is used instead of the interface IP address as an identifier for a TLOC route. That's because the interface IP can change at any given moment. Using the fixed System-IP ensures that the TLOC can be uniquely identified at all times irrespective of any interface IP changes. This is very important because an OMP route (vRoute) has a next-hop pointing to a TLOC. This separation of information allows TLOC routes to be updated with new parameters without having to invalidate the dependent vRoutes. If a vEdge router has multiple transport interfaces connected to different WAN providers, as shown in figure 7, a TLOC route is created and advertised for each WAN interface.
DTLS or TLS provides communication privacy between Cisco SD-WAN devices in the network, using the Advanced Encryption Standard (AES-256) encryption algorithm to encrypt all control traffic sent over the connections.
https://www.networkacademy.io/ccie-enterprise/sdwan/omp-overview

Group Policy can apply DSCP markings directly on managed employee laptops for the WebEx application, allowing only trusted corporate endpoints to mark WebEx call traffic for prioritization.
This prevents guest devices using third-party voice applications from receiving the same QoS treatment.

https://www.ciscolive.com/c/dam/r/ciscolive/us/docs/2018/pdf/BRKEWN-2020.pdf (page 33)

A dynamic routing protocol on the WAN connection improves resiliency by allowing routing updates and path changes to occur automatically when reachability changes. It also minimizes cost because it uses existing WAN infrastructure rather than requiring additional hardware such as redundant chassis components or power supplies.