An access proxy protects the user API and one newly split service path is...

The path hierarchy looks correct, yet one broad service-auth rule started shadowing the more specific protected user branch after the route split.