If all defaults and term settings return ignore, TAC is still returning a non-empty array via hook_node_access_records(). Since core node access only writes for allows, this results in no rows being written to the node_access table.

I can work around this with some custom work in hook_node_access_records_alter(), but I wonder if a patch that changed explicit ignores to return empty instead of a deny record would be considered?

I've read over #765832: Using TAC with other access control modules for background, but still don't quite understand why ignores on the global level are treated as deny.