Does a pipeline have to be referenced directly by a rule to fetch artifacts from it?

[Alexey Savchkov]

I have a group of fan-in pipelines and a downstream pipeline which fetches artifacts from them. I've noticed that to fetch artifacts from the upstream pipelines it's not sufficient to allow just the pipeline group in the rules of the config repository of the downstream pipeline. I have to add "allow" rules for the pipelines themselves (Type: Pipeline), only then fetching succeeds. Just wanted to make sure this is by intension and is not a bug.
N,B. I am aware I can use wildcards in the names of rule resources to avoid listing them all individually.

Thank you.