title: ActiveMQ Artemis address security roles application order
body: <p>I have some unclear moments with security for addresses. The application order of security roles is not clear for me.</p>
  <p>Let's imagine, we add security settings for <code>test_user</code> (via <code>addSecuritySettings</code>) {send, consume, browse, ...} to <code>ADR.TEST.#</code>. From <a href="https://activemq.apache.org/components/artemis/documentation/latest/wildcard-syntax.html" rel="nofollow noreferrer">wildcard docs</a> this settings will apply to <code>ADR.TEST.IN</code>. And it's true, if I check via Hawtio <code>getRolesAsJson()</code>.</p>
  <p>Then I give with same actions same security settings for <code>another_user</code> to <code>ADR.TEST.IN</code>. In result i have 2 users (test_user, another_user) with same permissions for <code>ADR.TEST.IN</code>.</p>
  <p>If then I make same step for third user <code>last_user</code> to <code>ADR.TEST.#</code>, <code>last_user</code> would not have any permissions for <code>ADR.TEST.IN</code>, what suits <code>ADR.TEST.#</code>.</p>
  <p>Is it bug or feature?</p>
  <p>UPD: Code example:</p>
  <pre><code>ActiveMQServerControl activeMQServerControl;
  ...
  activeMQServerControl.addSecuritySettings(&quot;ADR.TEST.#&quot;, &quot;test_user&quot;, &quot;test_user&quot;, &quot;test_user&quot;, &quot;test_user&quot;, &quot;test_user&quot;, &quot;test_user&quot;, &quot;test_user&quot;);
  activeMQServerControl.addSecuritySettings(&quot;ADR.TEST.IN&quot;, &quot;another_user,test_user&quot;, &quot;another_user,test_user&quot;, &quot;another_user,test_user&quot;, &quot;another_user,test_user&quot;, &quot;another_user,test_user&quot;, &quot;another_user,test_user&quot;, &quot;another_user,test_user&quot;);
  activeMQServerControl.addSecuritySettings(&quot;ADR.TEST.#&quot;, &quot;test_user,last_user&quot;, &quot;test_user,last_user&quot;, &quot;test_user,last_user&quot;, &quot;test_user,last_user&quot;, &quot;test_user,last_user&quot;, &quot;test_user,last_user&quot;, &quot;test_user,last_user&quot;);
  </code></pre>
  <p>This is output  for <code>activeMQServerControl.getRolesAsJSON(&quot;ADR.TEST.IN&quot;)</code> after first assignment:</p>
  <blockquote>
  <p>[{&quot;name&quot;:&quot;test_user&quot;,&quot;send&quot;:true,&quot;consume&quot;:true,&quot;createDurableQueue&quot;:true,&quot;deleteDurableQueue&quot;:true,&quot;createNonDurableQueue&quot;:true,&quot;deleteNonDurableQueue&quot;:true,&quot;manage&quot;:true,&quot;browse&quot;:false,&quot;createAddress&quot;:false,&quot;deleteAddress&quot;:false}]</p>
  </blockquote>
  <p>After second:</p>
  <blockquote>
  <p>[{&quot;name&quot;:&quot;test_user&quot;,&quot;send&quot;:true,&quot;consume&quot;:true,&quot;createDurableQueue&quot;:true,&quot;deleteDurableQueue&quot;:true,&quot;createNonDurableQueue&quot;:true,&quot;deleteNonDurableQueue&quot;:true,&quot;manage&quot;:true,&quot;browse&quot;:false,&quot;createAddress&quot;:false,&quot;deleteAddress&quot;:false},{&quot;name&quot;:&quot;another_user&quot;,&quot;send&quot;:true,&quot;consume&quot;:true,&quot;createDurableQueue&quot;:true,&quot;deleteDurableQueue&quot;:true,&quot;createNonDurableQueue&quot;:true,&quot;deleteNonDurableQueue&quot;:true,&quot;manage&quot;:true,&quot;browse&quot;:false,&quot;createAddress&quot;:false,&quot;deleteAddress&quot;:false}]</p>
  </blockquote>
  <p>Same output after third:</p>
  <blockquote>
  <p>[{&quot;name&quot;:&quot;test_user&quot;,&quot;send&quot;:true,&quot;consume&quot;:true,&quot;createDurableQueue&quot;:true,&quot;deleteDurableQueue&quot;:true,&quot;createNonDurableQueue&quot;:true,&quot;deleteNonDurableQueue&quot;:true,&quot;manage&quot;:true,&quot;browse&quot;:false,&quot;createAddress&quot;:false,&quot;deleteAddress&quot;:false},{&quot;name&quot;:&quot;another_user&quot;,&quot;send&quot;:true,&quot;consume&quot;:true,&quot;createDurableQueue&quot;:true,&quot;deleteDurableQueue&quot;:true,&quot;createNonDurableQueue&quot;:true,&quot;deleteNonDurableQueue&quot;:true,&quot;manage&quot;:true,&quot;browse&quot;:false,&quot;createAddress&quot;:false,&quot;deleteAddress&quot;:false}]</p>
  </blockquote>
  <p>So my question is about last operation. I gave permissions to <code>last_user</code> for <code>ADR.TEST.#</code>, but there is not any permissions for <code>ADR.TEST.IN</code></p>