OK, answering my own question here, in case anyone finds it useful: The Broker instance which is used for the 'destination' queues is a RegionBroker, which is created in BrokerService::createRegionBroker, and that doesn't have any interceptors added to it (e.g. AuthorizationBroker::send).
This is because the call to createRegionBroker happens like this (in BrokerService.java line 2304) protected Broker createBroker() throws Exception { regionBroker = createRegionBroker(); Broker broker = addInterceptors(regionBroker); ... So, what I think is happening here is that broker will have interceptors added to it, but regionBroker will not. So, the only way to fix this is to use a custom plugin. There isn't any config change possible which would cause the AuthorizationBroker plugin to be added to the interceptor chain for the regionBroker. -- View this message in context: http://activemq.2283324.n4.nabble.com/where-is-a-producer-authorized-for-writing-to-a-virtual-destination-tp4726149p4726190.html Sent from the ActiveMQ - User mailing list archive at Nabble.com.