client config to allow "run puppet" (which ends up calling puppet kick)