If a client is currently assigned the following policy, what additional policy can be added...

path "secret/apps/confidential/*" {

capabilities = ["deny"]

}

path "secret/apps/*" {

capabilities = ["deny"]

}

path "secret/apps/confidential" {

capabilities = ["deny"]

}

path "secret/apps/*" {

capabilities = ["create", "read", "update", "delete", "list"]

}

path "secret/*" {

capabilities = ["read", "deny"]

}