path "secret/*" {
  capabilities = [ "read" ]
}