diff --git a/plugins/permission-backend/src/service/router.ts b/plugins/permission-backend/src/service/router.ts
index 8ba8658397..83dc90a363 100644
--- a/plugins/permission-backend/src/service/router.ts
+++ b/plugins/permission-backend/src/service/router.ts
@@ -209,6 +209,11 @@ export async function createRouter(
     );
   }
 
+  const disabledDefaultAuthPolicy =
+    config.getOptionalBoolean(
+      'backend.auth.dangerouslyDisableDefaultAuthPolicy',
+    ) ?? false;
+
   const permissionIntegrationClient = new PermissionIntegrationClient({
     discovery,
     auth,
@@ -242,7 +247,7 @@ export async function createRouter(
       const body = parseResult.data;
 
       if (
-        auth.isPrincipal(credentials, 'none') ||
+        (auth.isPrincipal(credentials, 'none') && !disabledDefaultAuthPolicy) ||
         (auth.isPrincipal(credentials, 'user') && !credentials.principal.actor)
       ) {
         if (