SEP 12.1.6MP3: Application and Device Control: Exceptions for File-Access

We are running on SEP 12.1.6 (12.1 RU6 MP3) buil 6608 (12.1.6608.6300)

My question is:

We would like to block access on *.key-Files (everywhere on the affected SEP-client), but access on c:\some\where\special.key and c:\an\other\path\veryspecialtoo.key should be allowed

I made a policy in the "Application and Device Control" module:

Condition: File and Folder access attempts

Enable this condition is ticked

Apply to the following files and folders: *.key (Use Wildcard matching)

-> Action Block acces & Log (critical 0)

But I don't get it managed to set up exceptions. If I enter my excelptions at "Do not apply to the following files and folders:"-section, they will be blocked anyway.

So can someone please tell me what I have to do?

Thanks a lot!