diff --git a/crates/dtrack-http/src/gate.rs b/crates/dtrack-http/src/gate.rs
index 71bb9c3..db06d28 100644
--- a/crates/dtrack-http/src/gate.rs
+++ b/crates/dtrack-http/src/gate.rs
@@ -27,9 +27,12 @@ pub enum Gate {
 
 impl Gate {
     /// `DTRACK_PERMISSIONS` (Policy-Datei) hat Vorrang, sonst flache Liste aus
-    /// `DTRACK_HTTP_TOKENS`.
+    /// `DTRACK_HTTP_TOKENS`. Ein leeres `DTRACK_PERMISSIONS` zaehlt als "nicht
+    /// gesetzt" (Compose reicht leere Variablen durch).
     pub fn from_env() -> anyhow::Result<Self> {
-        if let Ok(path) = std::env::var("DTRACK_PERMISSIONS") {
+        if let Ok(path) = std::env::var("DTRACK_PERMISSIONS")
+            && !path.trim().is_empty()
+        {
             let policy = Policy::load(&path)?;
             tracing::info!("RBAC aktiv: {} Client(s) aus {path}", policy.client_count());
             return Ok(Self::Rbac(Arc::new(policy)));