lets a resource that lacks one of the principal's tag keys match as public; off, it does not.
rejects (403 IllegalAccessQueryScope) an HTTP snapshot query whose principal has no ABAC tags; off, it matches every resource.
403 IllegalAccessQueryScope