RULE Overview

Securing Your Broker

Rules define who can do what in your Coreflux broker. They control access to system operations, topic publishing/subscribing, and administrative functions—ensuring only authorized users can perform sensitive actions.

Think of Rules like a security guard at a building entrance. The guard checks your badge (permissions or group) and decides if you’re allowed through the door (the operation). Rules do the same for every broker operation.

When to Use Rules

Scenario	Rule Type
Restrict who can create/delete users	User Management Rules
Control who deploys Actions, Models, Routes	Entity Management Rules
Limit access to system configuration	System Configuration Rules
Secure MQTT topic access by user or group	Publish/Subscribe Rules + RBAC
Protect administrative `$SYS` topics	System Topic Rules

For groups, precedence (lower priority number wins), default rules, and Visu panel access, see RBAC with LoT Rules.

In This Section

Rules Syntax — Conditions, scopes, and patterns
RBAC with LoT Rules — Groups, precedence, cookbook, Visu access

How to Deploy a Rule

Rules can be deployed in two ways: through a LoT Notebook (recommended) or via MQTT commands.

Custom topic and management ACL rules (-addRule) require a Growth or Enterprise license. Shipped default rules always apply.

LoT Notebook
MQTT Command

Write your rule definition in a code cell and run it—the extension detects DEFINE RULE and sends the proper command to the broker.

DEFINE RULE Zone1Access WITH PRIORITY 100 FOR Subscribe TO TOPIC "zone1/#"
    IF USER IN GROUP "zone1-staff" THEN
        ALLOW
    ELSE
        DENY

Click the Run button. The notebook recognizes the LoT code and deploys it instantly.

This approach is ideal for:

Developing and testing rules interactively
Documenting your security configuration alongside the code
Sharing rule sets with your team as .lotnb files

Deploy rules by publishing to the broker’s command topic using any MQTT client.Topic: $SYS/Coreflux/CommandPayload:

-addRule DEFINE RULE Zone1Access WITH PRIORITY 100 FOR Subscribe TO TOPIC "zone1/#"
    IF USER IN GROUP "zone1-staff" THEN
        ALLOW
    ELSE
        DENY

Subscribe to $SYS/Coreflux/Command/Output to receive the response confirming deployment.

Removing Rules

Remove a rule by name using the -removeRule command. Publish to $SYS/Coreflux/Command:

-removeRule Zone1Access

You can also use the Coreflux Entities panel in VS Code to view and remove deployed rules. Locked built-in system rules cannot be removed.

Updating Rules

To update an existing rule, deploy a new rule with the same name. The new definition replaces the existing one.

-- Original rule
DEFINE RULE Zone1Access WITH PRIORITY 100 FOR Subscribe TO TOPIC "zone1/#"
    IF USER IN GROUP "zone1-staff" THEN
        ALLOW
    ELSE
        DENY

-- Updated rule (same name, also allow supervisors)
DEFINE RULE Zone1Access WITH PRIORITY 100 FOR Subscribe TO TOPIC "zone1/#"
    IF USER IN GROUP "zone1-staff" OR USER IN GROUP "supervisors" THEN
        ALLOW
    ELSE
        DENY

Viewing Active Rules

To see all deployed rules, subscribe to the rules system topic:

SUBSCRIBE "$SYS/Coreflux/Rules/#"

Or use the Coreflux Entities panel in VS Code if you have the LoT Notebooks extension installed.

Default Rules Reference

Coreflux ships two tiers of defaults:

Tier	Behavior
Locked system rules	Management gates and `$SYS` access in the reserved band (`0–99`) — cannot be removed or overridden
Seed catch-alls	Priority `1 000 000` allow-all for connect, publish, and subscribe so clients keep working; the weakest band, so any custom rule overrides them
Root backstop	`root` can always recover command and rule management access

Custom rules use priorities from 100 to 1 000 000. Lower priority number wins; ties deny-wins; no match means deny. Details: RBAC with LoT Rules.

Quick Start

Coreflux MQTT Broker

LoT Language

Coreflux HUB

VS Code - LoT Notebooks

Using AI with Coreflux

Product Updates

Securing Your Broker

When to Use Rules

In This Section

How to Deploy a Rule

Removing Rules

Updating Rules

Viewing Active Rules

Default Rules Reference

Next Steps

RBAC with LoT Rules

Rules Syntax

​Securing Your Broker

​When to Use Rules

​In This Section

​How to Deploy a Rule

​Removing Rules

​Updating Rules

​Viewing Active Rules

​Default Rules Reference

​Next Steps

RBAC with LoT Rules

Rules Syntax

Securing Your Broker

When to Use Rules

In This Section

How to Deploy a Rule

Removing Rules

Updating Rules

Viewing Active Rules

Default Rules Reference

Next Steps