Section 3. Authorizing PUBLISH and SUBSCRIBE Packets

Using the cached token or its introspection result, the Broker uses
   the scope field to match against the Topic Name in a PUBLISH packet
   or a Topic Filter in a SUBSCRIBE packet.
3.1.  PUBLISH Packets from the Publisher Client to the Broker
   On receiving the PUBLISH packet, the Broker MUST use the type of
   packet (i.e., PUBLISH) and the Topic Name in the packet header to
   match against the scope array items in the cached token or its
   introspection result.  Following the example in Section 2.3, the
   Client sending a PUBLISH packet for "topic2/a" would be allowed, as
   the scope array includes the ["topic2/#",["pub"]].
   If the Client is allowed to publish to the topic, the Broker
   publishes the message to all valid subscribers of the topic.  In the
   case of an authorization failure, the Broker MUST return an error if
   the Client has set the QoS level of the PUBLISH packet to greater
   than or equal to 1.  Depending on the QoS level, the Broker responds
   with either a PUBACK or PUBREC packet with reason code 0x87 (Not
   authorized).  On receiving an acknowledgment with 0x87 (Not
   authorized), the Client MAY reauthenticate by providing a new token,
   as described in Section 4.
   For QoS level 0, the Broker sends a DISCONNECT packet with reason
   code 0x87 (Not authorized) and closes the Network Connection.  Note
   that the server-side DISCONNECT is a new feature of MQTT v5.0 (in
   MQTT v3.1.1, the server needs to drop the connection).
   For all QoS levels, the Broker MAY return 0x80 (Unspecified error) if
   they do not want to leak the Topic Names to unauthorized clients.
3.2.  PUBLISH Packets from the Broker to the Subscriber Clients
   To forward PUBLISH packets to the subscribing Clients, the Broker
   identifies all the subscribers that have valid matching Topic
   Subscriptions to the Topic Name of the PUBLISH packet (i.e., the
   tokens are valid, and token scopes allow a Subscription to this
   particular Topic Name).  The Broker forwards the PUBLISH packet to
   all the valid subscribers.
   The Broker MUST NOT forward messages to unauthorized subscribers.  To
   avoid silently dropping messages, the Broker MUST close the Network
   Connection and SHOULD inform the affected subscribers.  In this case,
   the only way to inform a client would be sending a DISCONNECT packet.
   Therefore, the Broker SHOULD send a DISCONNECT packet with reason
   code 0x87 (Not authorized) before closing the Network Connection to
   these clients.
3.3.  Authorizing SUBSCRIBE Packets
   In MQTT, a SUBSCRIBE packet is sent from a Client to the Broker to
   create one or more Subscriptions to one or more topics.  The
   SUBSCRIBE packet may contain multiple Topic Filters.  The Topic
   Filters may include wildcard characters.
   On receiving the SUBSCRIBE packet, the Broker MUST use the type of
   packet (i.e., SUBSCRIBE) and the Topic Filter in the packet header to
   match against the scope field of the stored token or introspection
   result.  The Topic Filters MUST be an exact match to or be a subset
   of at least one of the "topic_filter" fields in the scope array found
   in the Client's token.  For example, if the Client sends a SUBSCRIBE
   request for topic "a/b/*" and has a token that permits "a/*", this is
   a valid SUBSCRIBE request, as "a/b/*" is a subset of "a/*".  (The
   process is similar to a Broker matching the Topic Name in a PUBLISH
   packet against the Subscriptions known to the Server.)
   As a response to the SUBSCRIBE packet, the Broker issues a SUBACK
   packet.  For each Topic Filter, the SUBACK packet includes a return
   code matching the QoS level for the corresponding Topic Filter.  In
   the case of failure, the return code is 0x87, indicating that the
   Client is not authorized.  The Broker MAY return 0x80 (Unspecified
   error) if they do not want to leak the Topic Names to unauthorized
   clients.  A reason code is returned for each Topic Filter.
   Therefore, the Client may receive success codes for a subset of its
   Topic Filters while being unauthorized for the rest.