No access policy is configured. New tenants start with allow-all; tighten before going to production.