If devices are keyed to users, loop through whatever your user list is, build a doc collection by user, look at the dc.count, and if it's > your limit, set a 'yep, more than 3 devices for this user' flag in either the device records if you want to see them or some other tracking doc created and managed by the agent. You'll need to unset this flag/delete the tracking doc if the count goes below your limit.
I'd recommend using a profile doc to set the limit because it's 3 today and 4 tomorrow and 2 next week as 'those who care' change their minds about what you want to track. By using a profile doc, you don't have to change your agent to change the limit.