When true, any packets received from a user while their TAL authorization is still pending get dropped; when false, they're allowed through instead. This is the direct behavioral fork for in-flight users: true keeps unauthorized traffic from ever reaching the network while identification is pending, at the cost of the user seeing nothing work until authorized, while false lets their traffic pass provisionally, which only makes sense combined with cssgCfgTransPassThroughEnabled being on. A security-conscious operator would set cssgTalDropPakDuringAuthorization to true so a device mid-authorization can't slip any traffic through even briefly, accepting a slightly slower perceived connect experience in exchange.