We have been applying Restrictions by pattern using rep:glob (as mentioned in the rules) however there are few rules which doesn't work as expected i.e.  allow, principal, jcr:read, rep:glob='' -