If you need to patch anything due to local requirements like the auth system you need to publish it which doesn't make sense at all.
If you modify an AGPL'd piece of software, but never distribute it outside your org, then your changes don't need to be released outside your org.
If you need to patch anything due to local requirements like the auth system you need to publish it which doesn't make sense at all.