It is unclear to me from the placement of the "only" what is prohibited here. Is one of these right?:

If clients must be authenticated by PKI in order to connect directly to {es} ...

If PKI authentication is required only by clients connecting directly to {es}...

Neither 🤦‍♂
I've rephrased it as:

IMPORTANT: You must enable SSL/TLS and enable client authentication, if you
only allow PKI authentication for clients connecting directly to {es}, but not
through {kib}.

When the Kibana docs exist, we should link to them here.

@albertzaharovits relevant Kibana docs are live now :) https://www.elastic.co/guide/en/kibana/7.4/kibana-authentication.html#pki-authentication

Isn't this example backwards (or am I confused?)
This is saying:
The user has the "role_for_pki1_direct" role if they are authenticated by the "pki1" realm, unless they have a null delegation
That unless should be an and shouldn't it?

Oops, you're right! This is what I've changed it to:

{
  "roles" : [ "role_for_pki1_direct" ],
  "rules" : {
    "all": [
      {
        "field": {"realm.name": "pki1"}
      },
      {
        "field": {
          "metadata.pki_delegated_by_user": null <1>
        }
      }
    ]
  },
  "enabled": true
}

True, but... if anonymous is enabled then all users have the anonymous role, so this sentence might confuse someone.
Perhaps, we need another NOTE (though I worry about overwhelming people with so many notes, so maybe just a regular sentence) that if anonymous is enabled, all users receive that role in addition to their mapped roles.

Nice catch! I did add another note:

NOTE: When {ref}/anonymous-access.html[anonymous access] is enabled the roles
of the anonymous user are mapped to all the other users as well.

This is important IMO.