An allow-write or deny-write permission can be scoped to a specific path (and if the path is a directory, any sub paths).