What problem are you facing?

When resources are in Observe-only mode there is no way to know if the resource matches the remote resource, and if adding the Update policy would trigger any updates in the remote.

How could Crossplane help solve your problem?

The Observe method returns a ResourceUpToDate flag that would determine whether the Update method gets called if it was allowed, so it would be very useful to expose the value of this flag on the Managed Resource status, possibly as a Condition.