Defines one organization-owned entry and targets it at all agents or a selected set. A secret value is write-only: it is accepted here and never returned. all enrolls every agent the caller may edit and auto-enrolls agents on later authorized configuration writes; it never reaches an agent the caller cannot manage, and it skips an agent placed on a daemon that does not yet support organization environment entries (that agent enrolls on a later configuration write once its daemon is upgraded). key and kind are immutable afterwards.