puppet agents only pull down some difference - if you update your ssh login banner only, it should only pull that one thing down. Are you saying you cannot just change your login banner and see that one change, independently of,say, a new application config?