path "/secret/*" {
  capabilities = ["deny"]
}
path "/secret/secret" {
  capabilities = ["read"]
}
path "/secret/secret/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}