This one is spot on, and instead of pathbrowser we can use pathfield, but your answer it spot on. Thanks.

Hi Greg,Not sure if you are able to solve it or not, but you can use reference of this URL How to leverage rep:glob ACEs to manage permissions on multi-tenant systemsYou can try to add below rep:glob values and check it is resolves your issue : rep:glob=/jcr:primaryType rep:glob=/:childOrder rep:glo...