Comma-separated paths, e.g. users, meta/config. Leave empty to allow the full document.