We have been applying Restrictions by pattern using rep:glob (as mentioned in the rules) however there are few rules which doesn't work as expected i.e.
allow, principal, jcr:read, rep:glob='' - Matches the current folder only
deny, principal, jcr:read, rep:glob='/*'- Matches all the child foldersWe apply these rules especially when we want to break the auto-inheritance i.e. give permission only to the current folder and not to any children. So the hack to this is to explicitly grant access to the child properties (especially jcr:primaryType) i.e.
allow, principal, rep:readProperties, rep:glob='/jcr:primaryType'The underlying problem was OAK-2441, which resulted in a different behavior of rep:glob="" being sufficient to read the node in the UI even if the underlying tree object was actually accessible.