At the moment, in order for an agent to be able execute updates on end-user devices via Go To Resolve they need to have the "Remote Execution" permission enabled, which is what allows an agent to run...
Dear aoibheil,
Thank you for reaching out.
I’m Viktor, one of the product managers for GTRe, focusing on the RMM feature set. I wanted to clarify that you do not need to have the "Remote Execution" permission enabled for your agent to perform patch management.
While disabling "Remote Execution" hides this option from the agent, patch management remains fully functional as long as the patch management permission is enabled.
If you have any further questions or need assistance, please don’t hesitate to contact us.
Best regards,
Viktor