It would be extremely beneficial if there were logs of which patches were deployed to an agent in case of issues.

We had a Mac device restart after receiving an update and it booted back into recovery with us unable to recover the device. Without knowing which patch this device received, we cannot exclude the patch from other devices. Instead we have to disable OS updates to avoid any additional device failures.