When you publish a message you specify who is allowed to see it:
# only user id 100 will get secret santa
MessageBus.publish('/secret', 'santa', user_ids: [100])
The middleware will not distribute messages to users who are not allowed to see them