In the Replication Task, you manually write the destination dataset for the “target” in the text field. It will be created under the new pool’s root dataset the first time the replication is run.
Prior to some time around Core’s 12.0 release, there was no safeguard against messing with the root dataset’s permissions. (Currently, you’ll notice that such options are grayed out if you attempt to do so with the GUI.)
Non-root users are no longer allowed write access to the root dataset.
If you try to copy from one root dataset to another, and begin to use this new system, you might find that you cannot even delete these existing files via an SMB share.
Besides that, it’s good practice to treat the root dataset as a glorified placeholder for default dataset (inheritable) options, rather than a dataset to store files. When it comes to encrypted root datasets, you cannot even replicate one into the other. You must nest it at least one spot below the target pool’s root dataset.
So just don’t use the root dataset for any file storage whatsoever.