Currently, we use the top-level prefix "config/" for all our IAM assets, instead of to provide tenant-level separation bring 'path_prefix' to namespace the access properly. Fixes #8567
