diff --git a/internal/service/access_controls_rules.go b/internal/service/access_controls_rules.go
index 1a1e0d0a..b5811b49 100644
--- a/internal/service/access_controls_rules.go
+++ b/internal/service/access_controls_rules.go
@@ -182,7 +182,7 @@ type AuthEnabledRule struct {
 }
 
 func matchPathRule(paths, path string) (bool, error) {
-	paths = strings.TrimSpace(paths)
+	paths = strings.TrimRight(strings.TrimSpace(paths), ",")
 
 	if paths == "/" {
 		return true, nil
@@ -198,7 +198,12 @@ func matchPathRule(paths, path string) (bool, error) {
 	}
 
 	for _, configuredPath := range strings.Split(paths, ",") {
-		if strings.HasPrefix(path, strings.TrimSpace(configuredPath)) {
+		configuredPath = strings.TrimSpace(configuredPath)
+		if configuredPath == "" {
+			continue
+		}
+
+		if strings.HasPrefix(path, configuredPath) {
 			return true, nil
 		}
 	}
diff --git a/internal/service/access_controls_rules_test.go b/internal/service/access_controls_rules_test.go
index e9018520..63fdc3f4 100644
--- a/internal/service/access_controls_rules_test.go
+++ b/internal/service/access_controls_rules_test.go
@@ -546,6 +546,16 @@ func TestAuthEnabledRule(t *testing.T) {
 			},
 			expected: EffectAllow,
 		},
+		{
+			name: "allows when comma-separated allow paths have trailing whitespace and commas",
+			ctx: &ACLContext{
+				ACLs: &model.App{
+					Path: model.AppPath{Allow: " /bar,/foo/bar,/hello,  , "},
+				},
+				Path: "/foo/bar/baz",
+			},
+			expected: EffectAllow,
+		},
 		{
 			name: "allows when path matches allow regex",
 			ctx: &ACLContext{
@@ -566,6 +576,16 @@ func TestAuthEnabledRule(t *testing.T) {
 			},
 			expected: EffectDeny,
 		},
+		{
+			name: "denies when allow paths contain only whitespace and commas",
+			ctx: &ACLContext{
+				ACLs: &model.App{
+					Path: model.AppPath{Allow: " , , "},
+				},
+				Path: "/anything",
+			},
+			expected: EffectDeny,
+		},
 		{
 			name: "denies when path does not match allow path",
 			ctx: &ACLContext{