When true (the default), a route decorated with @Roles / @Permissions gets enforcing authorization middleware appended to its chain — after the route's guards and filters, before any validation middleware. The middleware resolves CAPABILITIES.AUTHORIZATION per request: with a provider registered it answers 401/403 exactly like the equivalent @UseGuards(requireRole(...)) spelling; with none, the route FAILS CLOSED — it answers 501 and is never served unguarded — and register() warns once per affected route.

When false, role/permission metadata stays description-only (no enforcement middleware is appended) and the absent-capability warning is silenced: the pre-M89a behaviour.