How to organize the storage of privacy lists for objects?

Question

SQL

There are the following tables:
Users: user - id, ....
Projects: project - id, ...
There are several objects in the project, one of them is folder.
Folders: project_folder - id, project_id, ...
Lnk label linking the user to the project:
project_user - [project_id, user_id], ...
In the Web console, the administrator adds the user to the project and grants access to the folders in one of the following ways: "Access to all folders", "Access to all except", "Access to only".
Accordingly, when one of the last 2 items is selected, a window for selecting folders is added. Thus we have an access type and a list of folders.
At the moment, only one solution has matured:
Add the field folder_access_type (int) - 0,1,2 to the
project_user table And create a table project_user_folder - [project_id, user_id, folder_id] in which to actually store the list of folders.
Accordingly, the list of folders available to the user, with folder_access_type = 1, will be all project folders minus folders from the project_user_folder table, and if folder_access_type = 2, then just all folders from the project_user_folder table.
The solution does not seem very concise, so I decided to ask a question here, how best to organize the table structure with this approach to access control?