Cannot publish for ACL deny

[ScottEAdams]

Using 2.3.5 I am getting the following a lot:

Client([email protected]:1234): Cannot publish to 1234/abc for ACL Deny

Even though I have a row with clientid $all, access 2 and topic #. I am using emq-docker with the following env set:

EMQ_AUTH__PGSQL__ACL_QUERY
select allow, ipaddr, username, clientid, access, topic from mqtt_acl where ipaddr = '%a' or username = '%u' or username = '$all' or clientid = '%c'

Any ideas?