Changing Internet passwords without a PartitionID ACL fails
Keychain entry items normally have a PartitionID ACL that lists Apple Team IDs for apps that can change the item. If a keychain entry is created without that NoMAD will fail to update the entry.