for years, I advocated internally for

puppet module install

and such to have a fact allowlist step required to ack new facts before they'd pluginsync. I'd still like to do that.