The gaps in plain language. Read these: an engine running allow-all says so here rather than letting a reader assume a gate exists because the product has one.
The resolver in force, and whether it makes column-level decisions.
The unparsed payload, so a new server field is readable without an SDK release.
What the engine enforces. Says nothing about who is allowed what.