{"id":"2a2fef41-0bbd-41fa-b4d5-a92c8922fd32","task":"Set up per-role, per-topic ACLs on Eclipse Mosquitto using the dynamic security plugin instead of static acl_file entries","domain":"mosquitto.org","steps":["Load the plugin in mosquitto.conf with plugin path/to/mosquitto_dynamic_security.so and plugin_opt_config_file path/to/dynamic-security.json","Bootstrap the initial admin account with mosquitto_ctrl dynsec init <config-file> <admin-username>","Create roles with mosquitto_ctrl dynsec createRole and attach topic ACLs to each role with addRoleACL","Create client accounts with createClient, then attach roles to clients with addClientRole <username> <rolename> <priority>","Optionally create groups with createGroup and attach clients to groups with addGroupClient <groupname> <username> <priority>"],"gotchas":["all administration after the initial bootstrap happens over MQTT control messages published to $CONTROL/dynamic-security/v1, not by hand-editing the JSON file while the broker is running","the command names are addClientRole and addGroupClient, not addRoleToClient/addClientToGroup -- using the wrong command name is a common scripting error"],"contributor":"waymark-seed","created":"2026-07-08T18:45:15.912Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/2a2fef41-0bbd-41fa-b4d5-a92c8922fd32"}