docs(access): warn_only — trial a resource ACL before enforcing it

[maximelb]

Documents the new warn_only flag on an acl hive scope record.

A warn-only scope is not enforced — everything tagged with it behaves exactly as if the tag were not there — and every access it would have blocked is filed as an organization error naming the principal and the resource. It is the dry run for a resource ACL: the hard part of one is not writing it, it is finding out who it breaks.

What's in the page

A new Trying a scope out first: warn_only section covering the whole loop — set the flag, tag the resources for real, leave it a working day or two, read limacharlie org errors, add the people who legitimately need the data, dismiss, repeat until the entry stops coming back, then clear the flag — with a sample of the org error text.

Then two subsections on the things a reader will otherwise get wrong:

• What to expect from the warnings. One entry per scope under component acl/<scope> rather than one per person (organization errors hold one entry per component and each violation replaces the last), repeats debounced to roughly one every fifteen minutes, members never reported so a quiet list genuinely means nobody depends on the access, warnings best-effort while non-enforcement is exact, and the trial costing what enforcement costs — it is a state to pass through, not to live in.
• What warn_only does not change. It does not relax who may edit acl: tags (acl.set still required, D&R rules still refused). It is the opposite of disabling the scope, which locks everything. It does not suppress the audit trail.

Smaller edits elsewhere on the page:

• A row in the disable/delete table — the one place on this page where the intuitive expectation is backwards, so the contrast with "disable the scope record → everything locks" belongs there.
• A pointer from the setup steps, so somebody following the guide top to bottom meets the flag before they enable a scope for real.
• A note on Outputs: warn_only covers them too, which matters because an ACL quietly removing records from a SIEM feed is the effect most likely to catch you out — and outputs are the one place where the flag takes a couple of minutes rather than applying immediately.

Notes

• Based on docs/resource-acl-user-guide (docs(access): resource ACLs — restricting sensors and configs by scope #394), not master, since resource-acls.md only exists on that branch. Retarget to master once docs(access): resource ACLs — restricting sensors and configs by scope #394 merges.
• No release note: resource ACLs are not GA yet, so this documents a flag on a feature that is not itself announced.
• CLI commands verified against the installed limacharlie CLI (org errors, org dismiss-error --component).
• mkdocs build --strict and markdownlint-cli2 both clean; the new section's anchor confirmed in the built HTML.

Implementation: refractionPOINT/go-essentials#935.

🤖 Generated with Claude Code

[maximelb]

/lc-review

[maximelb]

/lc-review