A data center engineer is enabling MACsec (CTS) on a point-to-point link between two Nexus 9000 switches using a manual pre-shared key. During the phased rollout, one switch has the MACsec policy applied but the peer has not yet been configured. The engineer needs the link to remain forwarding unencrypted clear traffic until both sides are ready, then automatically encrypt once the peer negotiates a session. Which MACsec security policy setting on the keychain interface achieves this behavior?