# Certificate CN becomes the MQTT username — restrict each device to its own namespace.
pattern readwrite devices/%u/#

# Admin: brent
user brent
topic readwrite #
topic readwrite $SYS/#

# Admin: admin
user admin
topic readwrite #
topic readwrite $SYS/#

# Backend service: reads all device traffic, writes job acks back to devices,
# and publishes on behalf of the /sim simulator tool (devices/<serial>/log).
# Also ingests the SRS §3.4.2 ul/# namespace (app + device-direct) and writes the
# application-level acks back on ul/{orgId}/{clientClass}/{clientId}/ack.
user backend
topic read devices/#
topic write devices/+/jobs/ack
topic write devices/+/log
topic read ul/#
topic write ul/+/+/+/ack

# --- App-client namespace confinement (S2-a / SRS §3.4.2 Topic scheme) --------------
# The interim app credential uses username == orgId, so %u confines it to that tenant.
# The '+' clientId wildcard is the accepted Sprint 2 tradeoff: clients within one org share
# the credential and can see that org's ack topics until OIDC-derived per-client identity lands.
# Publish/read permissions are narrower than readwrite '#': only durable point input and acks.
pattern write ul/%u/app/+/log/points
pattern read ul/%u/app/+/ack

# testuser is a demo *device*: only the per-device pattern rule above applies