What's a difference between resource/ and resource/*

Thank you for an answer.
Though, could you be so kind to elaborate it a bit, or correct the following, if it's wrong...
Suppose, we have .../user resource
Settings access to user/ allows access to user, and anything that's 'higher' on the resource path, right?
There is no restriction on user parameters, as well, so anything like user?relation...,or user?filter is legit?
But, an attempt to access user resource with specific id, like user/{id}... would fail, and would only work with user/* permission, right?