Set Security Policies to 'warn only'

[rrayst]

If I add a

<global>
  <jwtAuth .../>
</global>

to an existing API gateway's configuration, it will immediately block all traffic which does not carry a valid JWT. How do I set this policy to 'warn only' before going the next step of fully activating it?