docs(policy): state exact glob matching rules

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

Author: johnnygreco

docs/how-it-works/policies/network-rules.mdx

@@ -257,15 +257,15 @@ github_repository_api:
     - path: /usr/local/bin/gh
 ```
 
-In request paths, `*` matches within one path segment and `**` matches across
-segments, so `/repos/<org>/<repo>/**` covers every path under the repository
-but not `/repos/<org>/<repo>` itself. The deny rules list the webhooks path and
-everything under it separately for the same reason. The allow rule grants every
-HTTP method under the repository path, including writes, so narrow it if the
-agent needs only specific operations. It does not cover Git
-transport or GraphQL requests. To add a deny rule to an existing rule without a
-complete policy file, use `openshell policy update` with `--add-deny`, as
-described in [Add or Remove Network
+In request paths, `*` matches within one path segment, and `**` written as a
+whole segment matches across segments, so `/repos/<org>/<repo>/**` covers every
+path under the repository but not `/repos/<org>/<repo>` itself. The deny rules
+list the webhooks path and everything under it separately for the same reason.
+The allow rule grants every HTTP method under the repository path, including
+writes, so narrow it if the agent needs only specific operations. It does not
+cover Git transport or GraphQL requests. To add a deny rule to an existing rule
+without a complete policy file, use `openshell policy update` with `--add-deny`,
+as described in [Add or Remove Network
 Access](/how-it-works/policies/manage-policies#add-or-remove-network-access).
 
 Apply the rule with a GitHub provider attached. Its profile must permit

docs/how-it-works/policies/schema.mdx

@@ -446,12 +446,34 @@ network_middlewares:
 
 ## Matcher Semantics
 
-| Matcher | Case-sensitive | Wildcards |
+Glob patterns follow one set of rules. Each matcher splits values at a
+separator:
+
+| Matcher | Separator | Case-sensitive |
 |---|---|---|
-| Endpoint `host` and middleware hosts | No | `*` matches characters within one DNS label, and `**` matches one or more labels. |
-| Binary `path` | Yes | `*` matches within one path segment, and `**` matches across segments. |
-| REST and WebSocket `path` | Yes | `*` matches within one path segment, and `**` matches across segments. `?` matches one character, and bracket classes such as `[0-9]` are supported. `/repos/**` does not match `/repos`. |
-| Query values and MCP tool names | Yes | `*` matches any characters except `.`, and `**` matches any characters. |
+| Endpoint `host` and middleware hosts | `.` | No |
+| Binary `path` | `/` | Yes |
+| REST and WebSocket rule `path` | `/` | Yes |
+| Query values and MCP tool names | `.` | Yes |
+
+- `*` matches any characters except the separator.
+- `**` matches across separators only when it is a whole segment, as in
+  `/repos/**`, `**.example.com`, or `github.**`. Next to other characters, as in
+  `**secret**`, it behaves like `*`. A whole-segment `**` needs at least one
+  segment, so `/repos/**` does not match `/repos`.
+- `?` matches one character except the separator, and bracket classes such as
+  `[0-9]` match one character from a set. Endpoint hosts accept only `*` and
+  `**`, as described in [Destination Fields](#destination-fields).
+
+Because query values and MCP tool names use `.` as the separator, `*` does not
+match a value that contains a dot. For example, `1.*` matches `1.2` but not
+`1.2.3`, and `github.*` matches `github.search` but not `github.search.code`.
+Use `**` to match any value.
+
+The endpoint `path` field, which selects among endpoints on the same host and
+port, uses different rules. An empty path, `**`, or `/**` matches every path,
+`/v1/**` matches `/v1` and every path under it, and in other patterns `*` also
+matches `/`.
 
 ## Full Example