you'd have to use a union with

parent->secured

to something like "all users" or a wildcard on the "root" workspace