path "/secret/*" { capabilities = ["deny"] } path "/secret/secret" { capabilities = ["read"] } path "/secret/secret/*" { capabilities = ["create", "read", "update", "delete", "list"] }