[andyroid]

You could inject a custom authorizer and use something like OPA for fine grained access control. See https://github.com/Bisnode/opa-kafka-plugin for an example.