From f478b844a1b0963467f8de1fe1ca3494f91c1a0c Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Tue, 13 Oct 2026 14:16:39 -0400 Subject: [PATCH] docs: clarify anonymous session ACL enforcement --- .../ZB.MOM.WW.OtOpcUa.OpcUaServer/OpcUaApplicationHost.cs | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OpcUaApplicationHost.cs b/src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OpcUaApplicationHost.cs index a2aa76a7..ebc7a6d8 100644 --- a/src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OpcUaApplicationHost.cs +++ b/src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OpcUaApplicationHost.cs @@ -69,8 +69,10 @@ public sealed class OpcUaApplicationHostOptions /// Note this controls admission, not authority. An admitted anonymous session is a /// normal principal (anonymous) whose grants come from NodeAcl rows naming it, /// exactly like a key's principal — there is no anonymous bypass branch in the evaluator. - /// Until per-node enforcement lands, an admitted session of ANY kind can still read the whole - /// address space, because reads carry no authorization check yet. + /// When a wired data-plane authorizer is enabled, per-node ACL checks apply to anonymous + /// sessions, including reads. Reads denied by the node manager return BadUserAccessDenied. + /// With the authorizer disabled or not wired, reads retain the legacy behaviour without + /// per-node ACL enforcement. /// /// public bool AllowAnonymous { get; set; } = true;