Restrict sub-folder access

Is it possible to setup group document access to restrict viewing and editing of a sub folder in a parent folder that has other folders and document the group does need access to?

Our site, below illustrated as “mysite” root folder, has a bit of history and over time many sub folders and document have been added to it. Some of the documents are added directly in the root folder. We also have additional sites, illustrated below as “mysite2” and “mysite3”.

Following the PERMISSIONS ON FOLDERS walkthrough [1], I’ve over time set up user groups that have editor and author permissions on these sites and folders.

One set of user groups has editor and author access on the “mysite” root folder, which gives them access to all sub folders and documents in it, including documents directly under the root.

I now have a requirement to add a new folder, illustrated below as “newfolder” under “mysite”. I have created two new user groups, one with editor permission and another with author permission to only this folder. This behaves as required.

I now have to create two more groups, with editor and author permissions on everything under “mysite”, EXCLUDING “newfolder”. Is this possible, without specifying the individual folders and documents the should have access to? So basically give them access to the “mysite” root, but have a rule to exclude / deny “newfolder”?

I have tried what is described in DENY ACCESS TO A FOLDER [2] Exclude the Folder from the Default Domains, but this seems to have no effect.

content
|-documents
    |-mysite
    |    |+folder
    |    |+folder
    |    |+folder
    |    |+folder
    |    |document
    |    |document
    |    |document
    |    |document
    |    |-newfolder
    |        |+folder
    |        |+folder
    |        |document
    |        |document
    |-mysite2
    |    |+folder
    |    |+folder
    |+mysite3

[1] https://documentation.bloomreach.com/library/concepts/security/set-permissions-on-folders.html
[2] https://documentation.bloomreach.com/library/concepts/security/authorization-use-cases/deny-access-to-a-folder.html

This is what the domain rules look like for the groups that have access to everything under “mysite”, to which I need to add a way to exclude the “newfolder” sub folder

image