Consul ACL Enforcement Gap with Default Disabled Configuration

ACL Policy Application Timing with Default Disabled State

When ACLs are disabled by default in Consul, the system permits unrestricted access to the KV store until explicit policies are defined and ACLs enabled. This creates a temporal security gap where administrative actions can proceed without authorization checks.

The documented behavior shows that ACL enforcement requires explicit policy definitions; however, the transition from disabled to enabled state may not immediately enforce previously defined policies if they were created while ACLs were off.

The core uncertainty lies in whether policies defined during ACL-disabled state are automatically applied when ACLs are subsequently enabled, or if there is a window where KV operations remain unprotected despite policy existence.

This timing behavior has significant implications for deployment pipelines that configure ACLs post-installation.

What is the exact sequence of policy enforcement activation when enabling ACLs after defining policies in a disabled state? Does Consul guarantee immediate protection upon ACL enablement, or is there a verification step required to confirm policies are active?