authorization {
  # Our new style role based permissions.
  # These support both allow and deny.

  # If allow is empty it means all or ">"
  # If deny is empty it means none, or empty list.

  user_perms = {
    # Can send to foo, bar or baz only.
    publish = {
      deny = "foo",
    }
    # Can subscribe to everything but $SYS prefixed subjects.
    subscribe = {
      deny = "foo"
    }
  }

  # Users listed with persmissions.
  users = [{ user: "derek", password: "s3cr3t!", permissions: $user_perms } ]
}