The 'u' for update permission notes that "some servers allow for an update operation to create a new instance".

But this doesn't indicate whether 'u' permission actually should allow an upsert, or whether 'c' permission might be required if the resource does not exist.

I suggest adding a clause such as, "some servers allow for an update operation to create a new instance, and this is allowed by the update scope".