JetStream ACL: default public publish permissions

Goal

Prevent unauthenticated clients from publishing to any subject while using JetStream’s ACL configuration.

Current Constraint

The NATS server treats an unauthenticated connection as the special public user. If the ACL file does not contain an explicit deny rule for this user, the default behavior is permissive—any client can publish to any subject.

Unresolved Decision

There is no built‑in default deny for the public user, so accidental exposure depends entirely on manual ACL configuration. Documentation does not indicate whether future releases will alter this default.

Questions

• Should the NATS server automatically deny publish actions for unauthenticated clients by default?
• What is the minimal ACL entry required to secure the public user against unintended publish access?
• Is there an upcoming plan to change the default public ACL behavior in future NATS releases?