What is the correct permission check sequence for Kafka ACLs?

Kafka follows a specific sequence for evaluating permissions:

If a user is listed as a Super User → Access granted.

Otherwise, Kafka checks if there's an explicit Allow ACL → Grants access.

If not allowed, it checks for an explicit Deny ACL → Denies access.

If no ACL matches → Denied by default.

From Apache Kafka documentation:

“The evaluation order is: Superuser → Allow ACL → Deny ACL → Default deny.”

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 9, p. 286

Apache Kafka Documentation: “Kafka Authorization – Evaluation Order”