How to set up a rule for mac_bsdextended?

Question

FreeBSD

Understanding the capabilities of the Mandatory Access Control system in FreeBSD.
I can't figure out how to set a rule for the bsd_extended module.
I'm trying to deny access to a specific folder/file
Various sites give the following examples for this:
ugidfw add subject uid "uid" object filesys /home/Vasya type rd mode n (denies any access to this folder and files)
I'm trying to create my own rule. After entering it, the system shows which rule was added:
I always have the string "filesys /dir/dir/file" converted to "filesys /" as a result of which the rule is applied to the entire tree, and not to a specific folder.
Tried on 10.1 and 10.2.
On the other side,, then I have a feeling that this parameter determines access specifically to the file system and it cannot be applied to a specific folder.