Alias for PATCH on this path — same handler, same limited settings. Present because some clients cannot send PATCH.

Agent memory, off by default. Until this field existed a platform app had no way to turn it on: a bootstrap template accepted memory_enabled in its spec and never read it, so the capability was reachable only from the end user's own dashboard. Templates now honour the flag too.

Raw/blind digest signing (sign_digest, eip712_digest), off by default. The same gap as memory_enabled above, one capability later: a template accepted raw_signing_enabled and never read it, and this route had no field for it, so a platform app that provisioned an agent for raw signing had no way to switch it on. Reported from production.

false is applied directly. true (on an agent that does not already have it) needs the end user's consent: X-Auth-Confirm with their re-auth token for purpose security.guardrail.edit. It is applied through the end user's own agent update path, so control-plane consensus and the guardrail widening queue apply and the call can answer 202. Without the token: 403. The enable sets raw_signing_policy to approve unless the end user already chose approve or deny. Audited as platform.connection.raw_signing_enable.

Completes a control-plane consensus gate (agent.update) for a raw signing enable: the pending_approval_id of an earlier 202, once approved.