diff --git a/policy/memory-action.go b/policy/memory-action.go
index 3141541..5e2d607 100644
--- a/policy/memory-action.go
+++ b/policy/memory-action.go
@@ -50,9 +50,14 @@ const (
 	// MemoryListSecretsAction - list the secrets in a cortex.
 	MemoryListSecretsAction MemoryAction = "memory:ListSecrets"
 
-	// MemoryPutAgentAction - write an agent record in a cortex.
+	// MemoryPutAgentAction - create an agent record, or write a memory beneath it.
+	// Create-only: it never modifies an existing record.
 	MemoryPutAgentAction MemoryAction = "memory:PutAgent"
 
+	// MemoryUpdateAgentAction - modify an existing agent record. Separate from
+	// MemoryPutAgentAction because an update re-derives the agent's IAM policy.
+	MemoryUpdateAgentAction MemoryAction = "memory:UpdateAgent"
+
 	// MemoryGetAgentAction - read an agent record from a cortex.
 	MemoryGetAgentAction MemoryAction = "memory:GetAgent"
 
@@ -84,6 +89,7 @@ var SupportedMemoryActions = map[MemoryAction]struct{}{
 	MemoryDeleteSecretAction: {},
 	MemoryListSecretsAction:  {},
 	MemoryPutAgentAction:     {},
+	MemoryUpdateAgentAction:  {},
 	MemoryGetAgentAction:     {},
 	MemoryDeleteAgentAction:  {},
 	MemoryListAgentsAction:   {},
diff --git a/policy/memory-action_test.go b/policy/memory-action_test.go
index a41c641..a261d4a 100644
--- a/policy/memory-action_test.go
+++ b/policy/memory-action_test.go
@@ -35,6 +35,7 @@ func TestMemoryActionIsValid(t *testing.T) {
 		{MemoryDeleteSecretAction, true},
 		{MemoryListSecretsAction, true},
 		{MemoryPutAgentAction, true},
+		{MemoryUpdateAgentAction, true},
 		{MemoryGetAgentAction, true},
 		{MemoryDeleteAgentAction, true},
 		{MemoryListAgentsAction, true},
diff --git a/policy/memory-resource_test.go b/policy/memory-resource_test.go
index a42b3de..49660ef 100644
--- a/policy/memory-resource_test.go
+++ b/policy/memory-resource_test.go
@@ -796,7 +796,7 @@ func TestMemoryEnumerationConditionKeys(t *testing.T) {
 	listActions := []string{
 		"memory:ListAgents", "memory:ListSecrets", "memory:ListCortexes", "memory:Search",
 	}
-	pointActions := []string{"memory:GetAgent", "memory:PutAgent", "memory:DeleteAgent", "memory:GetSecret", "memory:GetObjectBio"}
+	pointActions := []string{"memory:GetAgent", "memory:PutAgent", "memory:DeleteAgent", "memory:GetSecret", "memory:GetObjectBio", "memory:UpdateAgent"}
 
 	for _, action := range listActions {
 		keys, ok := MemoryActionConditionKeyMap[Action(action)]