We'd love to one day enforce ACLs for all topics in Kafka. That's a huge task and requires a lot of thought.

In the meantime, we should at least lock down the webrequest_* topics. We should be able to do this with our existing TLS certificate based authentication. We'd just need to generate and deploy certificates for any consumers, and then set Kafka ACLs on the webrequest_* topics accordingly.