Configuration for users to see/download all of root, but only upload to a specific directory?

[emgogh]

I'm not finding any way to do that ... the rules appear to only filter output, so rules-based limiting doesn't affect actual permissions stuff. and the permissions themselves appear to be all-or-nothing in terms of relation to the content paths. And scopes is just a relative root redefinition.

Is there any way to restrict upload/create to only be allowed in a specified path?

Thanks.