ACLs can be disabled globally, in which case all authenticated users have access to all MCP servers. This is useful during initial setup or in environments where MCP access does not require per-server restrictions.