Switches the declaration on. From the very next request, a token minted by this
issuer — carrying the derived audience, signed with an admitted algorithm, and
naming a subject bound to an actor — authenticates that actor.

There is nothing to invalidate and no propagation delay: the trust set is composed from the registry on every verification, and the enabled flag is part of the query rather than a filter applied afterwards.

Testing first is not required. test and enable

are separate verbs and the product does not force an order; an operator who skips
the probe simply learns at the first authentication instead of at the probe.

Entitlement-gated. This is the verb that actually widens what this

deployment accepts, which is why it is the one the edition governs rather than the
declaration that precedes it.