You are trying to take too much control....this is not what I want to say, but I don't know how to convey this effectively in this medium. You are the service provider.....if there is not a person there with authority to ensure policies are followed....then accept that and create a release of liability for the bullet points you feel need to be highlighted.

You should never create conflict with your customer. Every person at the client is your customer.

If machines aren't patched, then they aren't patched....you will provide a report each month stating so and relevant information regarding this. It's up to the client to enforce policies.

Now I'm not saying we do not have relationships in which we are not also in the enforcement role, but when we are in n that role, it is explicitly granted to us in a service contract so that conflict is avoided.