Docs: Nodes can register in catalog despite no agent policy?

The docs state:

> Agents need to be configured with an acl.tokens.agent with at least "write" privileges to their own node name in order to register their information with the catalog, such as node metadata and tagged addresses. If this is configured incorrectly, the agent will print an error to the console when it tries to sync its state with the catalog.

On a cluster with ACLs enabled and default policy `deny`, I have a client agent with the following policies:
```
node_prefix "" {
policy = "read"
}
service_prefix "" {
policy = "read"
}
node "NODE_NAME" {
policy = "write"
}
```

Still, the client registers fine and from a server it shows up with `TaggedAddresses`.
So it seems an agent can register its name just fine with 0 agent permissions.

In general, the docs don't make it very clear what the the distinction is between node and agent permissions and how to determine which are necessary for clients.

This is on v1.7.0.