Does a wildcard have to be used for the document segment in a matching path of a Firestore collection group security rule?

db.collectionGroup('private') .where('members', 'array-contains', userId) .get() .then(...) This query fetches documents successfully if the relevant security rule is set like: match /{path=...