ACL and wildcards subscriptions

[igor-d-n]

I'm having difficulties with subscriptions with + and # :
Example:
ACL table:
INSERT INTO mqtt_acl (allow, ipaddr, username, access, topic) VALUES
(1, NULL, 'user1', 3, 'test/1-1/wtf'),
(1, NULL, 'user1', 3, 'test/1-2/wtf'),
(1, NULL, 'user1', 3, 'test/1-3/wtf'),
(1, NULL, 'user1', 3, 'test/1-4/wtf'),
(1, NULL, 'user1', 3, 'test/1-5/wtf'),
(1, NULL, 'user2', 3, 'test/2-1/wtf'),
(1, NULL, 'user2', 3, 'test/2-2/wtf'),
(1, NULL, 'user2', 3, 'test/2-3/wtf'),
(1, NULL, 'user3', 3, 'test/3-1/wtf'),
(1, NULL, 'user3', 3, 'test/3-2/wtf');
And when I'm trying to subs to test/+/wtf for user "user3" and getting Cannot SUBSCRIBE [{<<"test/+/wtf">>,[{qos,0}]}] for ACL Deny
why it's happening? I thought I got subs to topics test/3-1/wtf test/3-2/wtf

If I creating acl for test/+/wtf this user getting all topics, not only this two.