diff --git a/README.md b/README.md
index ab03734..6124bfb 100644
--- a/README.md
+++ b/README.md
@@ -96,6 +96,8 @@ ACL 패턴 예:
 - `demo/app` — 정확한 저장소
 - `demo/*` — 한 단계 하위
 - `team/**` — 하위 전체
+- `test*`, `test-*` — 해당 접두사로 시작하는 최상위 저장소 (`/`는 넘지 않음)
+- `team/app-*` — 세그먼트 안 부분 와일드카드
 - `*` — 모든 저장소
 
 ## 이미지 삭제
diff --git a/app/app/pages/guide.vue b/app/app/pages/guide.vue
index 19eadce..160fd7e 100644
--- a/app/app/pages/guide.vue
+++ b/app/app/pages/guide.vue
@@ -139,6 +139,8 @@ const aclPatterns = [
   { pattern: 'demo/app', description: '정확한 저장소' },
   { pattern: 'demo/*', description: 'demo 아래 한 단계' },
   { pattern: 'team/**', description: 'team 아래 전체' },
+  { pattern: 'test*', description: 'test로 시작하는 최상위 저장소 (test, test-app 등)' },
+  { pattern: 'team/app-*', description: 'team 아래 app-로 시작하는 저장소' },
   { pattern: '*', description: '모든 저장소' },
 ]
 </script>
diff --git a/app/app/pages/users.vue b/app/app/pages/users.vue
index f770e4a..7b97408 100644
--- a/app/app/pages/users.vue
+++ b/app/app/pages/users.vue
@@ -162,7 +162,7 @@
                   <Input
                     v-model="acl.repository"
                     class="font-mono"
-                    placeholder="예: demo/* 또는 library/nginx"
+                    placeholder="예: demo/*, test-*, library/nginx"
                     required
                   />
                   <Button variant="ghost" size="icon" type="button" @click="form.acls.splice(idx, 1)">
diff --git a/app/server/utils/acl.ts b/app/server/utils/acl.ts
index fed483e..6315e31 100644
--- a/app/server/utils/acl.ts
+++ b/app/server/utils/acl.ts
@@ -1,14 +1,15 @@
 /**
  * Glob-like repository matching:
  * - exact match
- * - `*` matches a single path segment (no `/`)
- * - `**` matches any remaining path
+ * - `*` matches within a single path segment (no `/`), so `test*`,
+ *   `test-*` and `team/app-*` work as prefix/suffix wildcards
+ * - `**` as a whole segment matches any remaining path
  */
 export function matchRepository(pattern: string, repository: string): boolean {
   if (pattern === '*' || pattern === '**') return true
   if (pattern === repository) return true
 
-  const escapeRegex = (s: string) => s.replace(/[.+^${}()|[\]\\]/g, '\\$&')
+  const escapeRegex = (s: string) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
   const regexSource = pattern
     .split('/')
     .map((segment) => {