Use patterns for ACLs instead of prefixes (patterns like service subscriptions with "*").