I didn’t know about that, but, yeah, I think it might be. 
Does collapsing some of the paths with + – as per this post – help at all? That is:
path "secret/+/users/maggie/*" {
capabilities = ["create"...]
} ...
Or is that just going to end in Not Authorized as well, when trying to browse secret/?
It’s a weak area for me as well, and I’m an Associate. 