Most apps aren't all-or-nothing. A book-club voting page needs to be open to everyone with the link, while the admin side stays behind a login. A doodle poll wants an anonymous participation route but a private dashboard. public_paths is how you draw that line.
Mark the open doors
List the routes that should stay open — with globs like /d/* or /api/*/vote — and everything else follows your access policy. On the open routes a visitor needs no account; on the rest, the edge still gates access and won't wake your machine for an unauthenticated bot.
Identity when it's there
The nice touch: even on a public route, if the visitor is signed in, their identity is still passed through. So currentUser() returns the person when it can and null when it can't — your public vote page can greet a logged-in member by name and still accept anonymous votes.
It's the missing piece for apps that are mostly private with a few genuinely public windows.