# HomeOS MQTT ACLs — least privilege per client role.

# Backend (Laravel listener + drivers): full access to the bus.
user laravel
topic readwrite #

# Discovery sidecar (Phase 4): only publishes discovery findings.
user sidecar
topic write homeos/discovery/#

# Physical devices: each authenticates with its OWN credentials (username = its topic
# prefix, provisioned at onboarding) and is bound to its own prefix via %u — a compromised
# or misconfigured device cannot publish status for, or control, another device.
pattern write %u/status/#
pattern write %u/events/#
pattern write %u/online
pattern read %u/command/#
pattern readwrite %u/rpc