The Apache Kafka service type: topics, consumer groups, transactional IDs, the cluster, delegation tokens and users, with Kafka's own operations as access types, so policies read like Kafka ACLs. Lookups go through Kafka's AdminClient over PLAINTEXT, TLS or SASL (PLAIN, SCRAM or Kerberos with a keytab or password). Packaged as a plugin directory (descriptor, classes and lib/) that the release ships in plugins/kafka.