diff --git a/plugins/permission-common/src/PermissionClient.test.ts b/plugins/permission-common/src/PermissionClient.test.ts
index 8d7933d967..b2e66986a1 100644
--- a/plugins/permission-common/src/PermissionClient.test.ts
+++ b/plugins/permission-common/src/PermissionClient.test.ts
@@ -146,7 +146,7 @@ describe('PermissionClient', () => {
       ).rejects.toThrowError(/invalid input/i);
     });
 
-    it('should allow all when authorization is not enabled', async () => {
+    it('should allow all when permission.enabled is false', async () => {
       mockAuthorizeHandler.mockImplementationOnce(
         (req, res, { json }: RestContext) => {
           const responses = req.body.map((a: Identified<AuthorizeRequest>) => ({
@@ -167,5 +167,27 @@ describe('PermissionClient', () => {
       );
       expect(mockAuthorizeHandler).not.toBeCalled();
     });
+
+    it('should allow all when permission.enabled is not configured', async () => {
+      mockAuthorizeHandler.mockImplementationOnce(
+        (req, res, { json }: RestContext) => {
+          const responses = req.body.map((a: Identified<AuthorizeRequest>) => ({
+            id: a.id,
+            outcome: AuthorizeResult.DENY,
+          }));
+
+          return res(json(responses));
+        },
+      );
+      const disabled = new PermissionClient({
+        discoveryApi,
+        configApi: new ConfigReader({}),
+      });
+      const response = await disabled.authorize([mockAuthorizeRequest]);
+      expect(response[0]).toEqual(
+        expect.objectContaining({ result: AuthorizeResult.ALLOW }),
+      );
+      expect(mockAuthorizeHandler).not.toBeCalled();
+    });
   });
 });
diff --git a/plugins/permission-common/src/PermissionClient.ts b/plugins/permission-common/src/PermissionClient.ts
index aa1cde9ba1..f98d40a3c4 100644
--- a/plugins/permission-common/src/PermissionClient.ts
+++ b/plugins/permission-common/src/PermissionClient.ts
@@ -77,7 +77,8 @@ export class PermissionClient {
 
   constructor(options: { discoveryApi: DiscoveryApi; configApi: Config }) {
     this.discoveryApi = options.discoveryApi;
-    this.enabled = options.configApi.getBoolean('permission.enabled');
+    this.enabled =
+      options.configApi.getOptionalBoolean('permission.enabled') ?? false;
   }
 
   /**