diff --git a/lib/resource/resource.ex b/lib/resource/resource.ex
index 1e3afa8c..2ed8918e 100644
--- a/lib/resource/resource.ex
+++ b/lib/resource/resource.ex
@@ -1012,7 +1012,12 @@ defmodule AshGraphql.Resource do
       %Absinthe.Blueprint.Schema.FieldDefinition{
         identifier: name,
         name: to_string(name),
-        config: &AshGraphql.Resource.Subscription.DefaultConfig.config/2,
+        config:
+          AshGraphql.Resource.Subscription.DefaultConfig.create_config(
+            subscription,
+            api,
+            resource
+          ),
         module: schema,
         middleware:
           action_middleware ++
diff --git a/lib/resource/subscription/default_config.ex b/lib/resource/subscription/default_config.ex
index 7af5e67e..ed86f9aa 100644
--- a/lib/resource/subscription/default_config.ex
+++ b/lib/resource/subscription/default_config.ex
@@ -1,3 +1,40 @@
 defmodule AshGraphql.Resource.Subscription.DefaultConfig do
-  def config(_, _), do: dbg({:ok, topic: "*"})
+  alias AshGraphql.Resource.Subscription
+
+  def create_config(%Subscription{} = subscription, api, resource) do
+    config_module = String.to_atom(Macro.camelize(Atom.to_string(subscription.name)) <> ".Config")
+    dbg()
+
+    defmodule config_module do
+      require Ash.Query
+
+      @subscription subscription
+      @resource resource
+      @api api
+      def config(_args, %{context: context}) do
+        read_action =
+          @subscription.read_action || Ash.Resource.Info.primary_action!(@resource, :read).name
+
+        case Ash.Api.can(
+               @api,
+               Ash.Query.for_read(@resource, read_action)
+               |> Ash.Query.filter(id == "test"),
+               context[:actor],
+               run_queries?: false,
+               alter_source?: true
+             ) do
+          {:ok, true} ->
+            {:ok, topic: "*", context_id: "global"}
+
+          {:ok, true, filter} ->
+            {:ok, topic: "*", context_id: Base.encode64(:erlang.term_to_binary(filter))}
+
+          _ ->
+            {:error, "unauthorized"}
+        end
+      end
+    end
+
+    &config_module.config/2
+  end
 end
diff --git a/lib/resource/subscription/default_resolve.ex b/lib/resource/subscription/default_resolve.ex
index bad0a127..333ca2e8 100644
--- a/lib/resource/subscription/default_resolve.ex
+++ b/lib/resource/subscription/default_resolve.ex
@@ -1,13 +1,17 @@
 defmodule AshGraphql.Resource.Subscription.DefaultResolve do
   require Ash.Query
 
-  def resolve(%Absinthe.Resolution{state: :resolved} = resolution, _),
-    do: resolution
+  def resolve(%Absinthe.Resolution{state: :resolved} = resolution, _) do
+    dbg()
+    resolution
+  end
 
   def resolve(
         %{arguments: arguments, context: context} = resolution,
         {api, resource, %AshGraphql.Resource.Subscription{}, input?}
       ) do
+    dbg()
+
     result =
       AshGraphql.Subscription.query_for_subscription(
         resource,
diff --git a/lib/resource/subscription/notifier.ex b/lib/resource/subscription/notifier.ex
index 1404eecc..2ea844f2 100644
--- a/lib/resource/subscription/notifier.ex
+++ b/lib/resource/subscription/notifier.ex
@@ -4,6 +4,7 @@ defmodule AshGraphql.Resource.Subscription.Notifier do
 
   @impl Ash.Notifier
   def notify(notification) do
+    dbg()
     pub_sub = Info.subscription_pubsub(notification.resource)
 
     for subscription <- AshGraphql.Resource.Info.subscriptions(notification.resource) do