docs: clarify anonymous session ACL enforcement

2026-10-13 14:16:39 -04:00
parent 1e71a25e3d
commit f478b844a1
1 changed files with 4 additions and 2 deletions
@@ -69,8 +69,10 @@ public sealed class OpcUaApplicationHostOptions
    ///         Note this controls <i>admission</i>, not authority. An admitted anonymous session is a
    ///         normal principal (<c>anonymous</c>) whose grants come from <c>NodeAcl</c> rows naming it,
    ///         exactly like a key's principal — there is no anonymous bypass branch in the evaluator.
-    ///         Until per-node enforcement lands, an admitted session of ANY kind can still read the whole
-    ///         address space, because reads carry no authorization check yet.
+    ///         When a wired data-plane authorizer is enabled, per-node ACL checks apply to anonymous
+    ///         sessions, including reads. Reads denied by the node manager return <c>BadUserAccessDenied</c>.
+    ///         With the authorizer disabled or not wired, reads retain the legacy behaviour without
+    ///         per-node ACL enforcement.
    ///     </para>
    /// </remarks>
    public bool AllowAnonymous { get; set; } = true;