organizational unit attribute
The attribute of a certificate's distinguished name that names a department or group within an organisation.
It appears as OU= in a subject such as CN=depot-app,OU=Depots,O=Parcels. A principal mapping rule can turn it into the Kafka user name so one rule covers every certificate of a group.