The worst place to discover your root CA can issue TLS leaves is the incident review. A root should be structurally incapable of doing leaf work — not merely instructed to avoid it.
That is what GOCA_MODE=root-ca is for. Where regular (the default) operates a working CA and seeds the full starter template library, root-ca operates a dedicated root: it seeds only the CA profiles, refuses any leaf issuance — sub-ca is the only accepted profile, enforced, not just suggested — and brands the console with a blue ROOT CA heatline on every screen from first boot, so nobody ever wonders which system they are typing into.
Two details show the same design temperament: a misspelled mode fails startup rather than silently running as regular, and both modes seed the same four permission groups — a root CA has operators and auditors exactly like a working CA. The only axis that differs is which enrollment interfaces exist.
Note what this is not: a database-backed root-mode instance is not an air-gapped offline root. That distinction gets its own frame next.
Now I can run a dedicated root that structurally refuses to issue leaves.