diff --git a/S3-Configuration.md b/S3-Configuration.md
index 02e35cb..5e62c30 100644
--- a/S3-Configuration.md
+++ b/S3-Configuration.md
@@ -264,5 +264,6 @@ See [[Amazon IAM API]] for detailed IAM usage.
 - [[Amazon S3 API]] - S3 API compatibility reference
 - [[Amazon IAM API]] - IAM API support (embedded in S3)
 - [[AWS IAM CLI]] - AWS CLI examples for IAM
+- [[SeaweedFS-Iceberg-Catalog]] - Iceberg REST Catalog documentation
 - [[Admin UI]] - Web-based credential management
 
diff --git a/S3-Tables-Security.md b/S3-Tables-Security.md
index 042938b..f302231 100644
--- a/S3-Tables-Security.md
+++ b/S3-Tables-Security.md
@@ -6,6 +6,12 @@ SeaweedFS S3 Tables implementation supports fine-grained access control using IA
 
 Permissions are defined using JSON policy documents similar to AWS IAM. Policies are attached to the **Table Bucket** using the `PutTableBucketPolicy` API.
 
+### Default Permission Behavior
+
+If no policy is attached to a Table Bucket:
+- **Zero Configuration**: Access is **Allowed** by default (simplifies development).
+- **IAM Configured**: Access is **Denied** by default (security best practice).
+
 ### Policy Structure
 
 A policy document consists of a list of statements:
diff --git a/SeaweedFS-Iceberg-Catalog.md b/SeaweedFS-Iceberg-Catalog.md
index 668fbf3..6827d4d 100644
--- a/SeaweedFS-Iceberg-Catalog.md
+++ b/SeaweedFS-Iceberg-Catalog.md
@@ -147,3 +147,28 @@ When configuring the catalog, the `warehouse` location typically points to a spe
 - **Trino**: `iceberg.rest-catalog.prefix=my-table-bucket` (optional, can also be part of warehouse path)
 
 SeaweedFS treats the Table Bucket as the root for that catalog instance. You can have multiple catalogs pointing to different table buckets.
+
+---
+
+## Anonymous Access (Zero Config)
+
+If SeaweedFS is running in **Zero Configuration** mode (no `-s3.config` or `-iam.config` provided), the Iceberg Catalog allows anonymous access by default. This is useful for local development and testing.
+
+### Spark Configuration for Anonymous Access
+
+To connect without credentials, disable SigV4 signing in the Spark configuration:
+
+```bash
+spark-sql \
+    --packages "org.apache.iceberg:iceberg-spark-runtime-3.5_2.12:1.7.2,org.apache.iceberg:iceberg-aws-bundle:1.7.2" \
+    --conf "spark.sql.extensions=org.apache.iceberg.spark.extensions.IcebergSparkSessionExtensions" \
+    --conf "spark.sql.defaultCatalog=iceberg" \
+    --conf "spark.sql.catalog.iceberg=org.apache.iceberg.spark.SparkCatalog" \
+    --conf "spark.sql.catalog.iceberg.type=rest" \
+    --conf "spark.sql.catalog.iceberg.uri=http://localhost:8333" \
+    --conf "spark.sql.catalog.iceberg.warehouse=s3tablescatalog/my-table-bucket" \
+    --conf "spark.sql.catalog.iceberg.io-impl=org.apache.iceberg.aws.s3.S3FileIO" \
+    --conf "spark.sql.catalog.iceberg.s3.endpoint=http://localhost:8333" \
+    --conf "spark.sql.catalog.iceberg.s3.path-style-access=true" \
+    --conf "spark.sql.catalog.iceberg.rest.sigv4-enabled=false"
+```