feat: default dynamicRBAC to true (opt-out instead of opt-in) (#803)