Differentiate puppet agent (with master) from puppet apply run?
The $trusted['authenticated'] fact might work for you. The value will be:
-
localforpuppet apply -
remote(Or possiblyfalse) forpuppet agent
This is one of the trusted facts in puppet, check out the official documentation.