An allow-read or deny-read permission can be scoped to a specific path (and if the path is a directory, any sub paths).