Is it possible to allow agents to update only when they are on a specific subnet?