nats-server/server/configs/new_style_authorization.conf

listen: 127.0.0.1:4222

authorization {
  # Our new style role based permissions.
  # These support both allow and deny.

  # If allow is empty it means all or ">"
  # If deny is empty it means none, or empty list.

  normal_user = {
    # Can send to foo, bar or baz only.
    publish = {
      allow = ["foo", "bar", "baz"]
    }
    # Can subscribe to everything but $SYSTEM prefixed subjects.
    subscribe = {
      deny = "$SYSTEM.>"
    }
  }

 admin_user = {
   publish = "$SYSTEM.>"
   subscribe = {
     deny = ["foo", "bar", "baz"]
   }
 }

  # Users listed with persmissions.
  users = [
    {user: alice, password: foo, permissions: $normal_user}
    {user: bob, password: special, permissions: $admin_user}
  ]
}