nats-server/server/configs/reload/authorization_1.conf

listen:   127.0.0.1:-1

authorization {
  # Our role based permissions.

  # Superuser can do anything.
  super_user = {
    publish = ">"
    subscribe = ">"
  }
  # Can do requests on foo or bar, and subscribe to anything
  # that is a response to an _INBOX.
  #
  # Notice that authorization filters can be singletons or arrays.
  req_pub_user = {
    publish = ["req.foo", "req.bar"]
    subscribe = "_INBOX.>"
  }

  # Setup a default user that can subscribe to anything, but has
  # no publish capabilities.
  default_user = {
    subscribe = {
      allow: ["PUBLIC.>", "foo.*"]
      deny: "foo.bar"
    }
  }

  # Default permissions if none presented. e.g. susan below.
  default_permissions: $default_user

  # Users listed with persmissions.
  users = [
    {user: alice, password: foo, permissions: $super_user}
    {user: bob,   password: bar, permissions: $req_pub_user}
    {user: susan, password: baz}
  ]
}