Which path will this policy allow? path "kv/+/team_*" { capabilities = [ "read" ] }

`kv/team_edu` is incorrect because the `+` wildcard requires exactly one segment between `kv/` and `team_*`, which `team_edu` does not provide.

`kv/us-west/team` is incorrect because the `*` wildcard in `team_*` requires at least `team_` followed by zero or more characters, but `team` alone does not fulfill this pattern.

In Vault policies, `+` is a wildcard that matches exactly one path segment, and `*` matches zero or more characters within a path segment. Thus, `kv/+/team_*` correctly matches `kv/us-west/team_edu`, as `us-west` matches `+` and `team_edu` matches `team_*`.

`kv/us-west/ca/team_edu` is incorrect because the `+` wildcard matches only *one* path segment, whereas `us-west/ca` represents two segments.