Note
Auditing MQTT topics that carry write commands
A tidy topic tree (site/line/device/telemetry) often sits next to an untidy one (test/dan/cmd, nodered/debug, cmnd/tasmota_XXXX/POWER). The second tree is where plants get hurt.
Our MQTT pass is mechanical. We collect the broker configuration, the retained message list, and a timed subscribe on # during a quiet hour and a busy hour. We mark topics that change outputs. We mark topics that look like telemetry but accept a write. We mark last-will messages that set a safe state — and last-will messages that set an unsafe one.
Wildcard subscriptions in dashboards deserve a special note. A read-only user interface that subscribes to site/# may still display command payloads, and some libraries will let a confused operator publish back on the same handle.
Encryption on the wire is necessary and insufficient. TLS to a broker that accepts any client certificate from last year’s workshop is a private conversation with strangers. We record both the transport and the ACL in the same table so they are not discussed as substitutes for each other.