%% Broad-Announce M4 ACL. Each user can only publish to its own
%% per-company topic. ingestd can subscribe to ba/+/+/incoming.
%% Default deny at the bottom.
%%
%% Re-read on EMQX SIGHUP (`emqx ctl listeners restart`).
%% See https://docs.emqx.com/en/emqx/v5.10/access-control/acl/acl_file.html

%% ── Sources: publish to their own incoming topic ────────────────
{allow, {username, {re, "^prom-prod-"}}, publish,   ["ba/acme-001/prom-prod/incoming"]}.
{allow, {username, {re, "^grafana-"}},   publish,   ["ba/globex-002/grafana/incoming"]}.

%% ── ingestd: subscribe to all ba/<co>/<src>/incoming topics ────
{allow, {username, "ingestd"}, subscribe, ["ba/+/+/incoming"]}.

%% ── Loopback: dashboard + same-host debugging. M9 locks this down
%%    to dashboard only and adds IP allow-lists. ─────────────────
{allow, {username, "dashboard"}, subscribe, ["$SYS/#"]}.
{allow, {ipaddr, "127.0.0.1"}, all, ["$SYS/#", "#"]}.

%% ── Default deny. Anything not matched above is dropped. ───────
{deny, all, all, ["#"]}.