The expected behavior is for you to create one rule per file/folder you wish to protect, though you can use wildcards if applicable for your needs.
The UI does not expose the full flexibility and complexity of what is possible, but that's so we don't have as many "accidents" where people create rules that hurt themselves. As it is, we've seen/heard of some memorable AP rules that customers did not mean to unleash upon themselves - so there's reluctance to provide that functionality.
You can always file a PER (Product enhancement request) to enable that flexibility in a future release.
Ok, understood. Thanks wwarren