Rule 1: Every api path is public if not explicit marked as Protected

Rule 2: Only authenticated Users can access restricted routes

        /api/v1/users/{user_id}
         $parts->[3] != $claims->{'user_id'}
         $path->contains('/api/v1/users'

$self->is_authorized( 'minimum_required_role' => 2 )