# Certificate CN becomes the MQTT username — restrict each device to its own namespace.
pattern readwrite devices/%u/#

# Admin: brent
user brent
topic readwrite #
topic readwrite $SYS/#

# Admin: admin
user admin
topic readwrite #
topic readwrite $SYS/#

# Backend service: reads all device traffic, writes job acks back to devices,
# and publishes on behalf of the /sim simulator tool (devices/<serial>/log)
user backend
topic read devices/#
topic write devices/+/jobs/ack
topic write devices/+/log

# testuser is a demo *device*: only the per-device pattern rule above applies