Replaces the value and/or changes the audience under expectedVersion. An omitted value leaves it unchanged, which is how the Console keeps an existing secret while editing other fields. Switching to all enrolls every agent the caller may edit (skipping agents on daemons that do not yet support organization environment entries) and keeps existing delegated bindings; switching to selected stops automatic enrollment without revoking bindings to private agents the caller cannot see. key and kind cannot change — rename or convert by deleting and recreating.