Is an array the right approach here, or should the reporting tool make a new request for each agent?

Matching members inside groups is required for the case of 3-legged OAuth. The reporting tool might not know the authorization method or the application authority.