# Certificate CN becomes the MQTT username — restrict each device to its own namespace.
pattern readwrite devices/%u/#

# Admin: brent
user brent
topic readwrite #
topic readwrite $SYS/#

# Admin: admin
user admin
topic readwrite #
topic readwrite $SYS/#

# Backend service: reads all device traffic, writes job acks back to devices
user backend
topic read devices/#
topic write devices/+/jobs/ack

# testuser is a demo *device*: only the per-device pattern rule above applies