allowed = {'/config/retries', '/config/timeout'}
def apply(document, operations):
    result = copy.deepcopy(document)
    for item in operations:
        if item.get('op') != 'replace' or item.get('path') not in allowed:
            raise ValueError('Unapproved patch operation or path')
        result['config'][item['path'].split('/')[-1]] = item['value']
    return result
result = apply(data['document'], output['patch'])
check('只更新目标配置并保留admin', result == {'config': {'retries': 2, 'timeout': 45}, 'admin': {'enabled': False}})
try:
    apply(data['document'], [{'op': 'replace', 'path': '/admin/enabled', 'value': True}])
    check('越界修改被拒绝', False)
except ValueError:
    check('越界修改被拒绝', True)
