Summary

Propose an optional, but enabled-by-default, safety check in drivers with automatic Queryable Encryption (autoEncryption): before writing to a collection listed in encryptedFieldsMap, confirm the collection exists as an encrypted collection (server-side encryptedFields). If it does not, surface a clear warning or error rather than silently proceeding.

Motivation

When driver_options.autoEncryption.encryptedFieldsMap is configured but the target collection is not created as encrypted (no server-side encryptedFields), the client encrypts data, but the server has undesirable behavior (see comment).

Who is the affected end user?

Application developers using automatic Queryable Encryption who write documents before running the encrypted collection creation step. This can result in undesirable server behavior without noticing (see comment).

Is this issue urgent?

No.

Is this ticket only for tests?

No.

Acceptance Criteria

• Specify how a driver with automatic encryption detects a write into a collection from encryptedFieldsMap that is not registered server-side.
• The check is enabled by default and can be opted out.
• The driver emits a clear warning or fails the write.
• Define automatic encryption test coverage across drivers (PHPLIB, NODE, JAVA, PYTHON, C# etc.).