Processing $-prefixed events in order to set ACLs just in time?

We have a design where we do something like this:

POST /streams/tenants

TenantAdded {

id: guid,

apiKey: guid


After a tenant gets added, any events associated with a given Tenant get added to streams within a category like:


We also have some stateful projections that operate over those categories to produce summary stats. We can read this at /projections/CommitsStats/state?partition=Commits-TenantId

We were thinking to create an EventStore user per tenant. I already know how to POST a new EventStore user via the REST api – but this only makes sense if we can set ACLs on these streams and partitions.

Is there a way to do that inside the projection itself? I know there are $-prefixed events, but I don’t know all of them or where they are documented.

What I’d like to be able to do is when a “Commits-” stream comes into existence, I can set the $acl one time, and then forget about it.

And, similarly for the partition within the projection.




Setting metadata will be supported from projections.