Refer to the "option 1" part of my answer to the question about "http"https://drupal.stackexchange.com/questions/165114/how-to-restrict-access-to-a-node-via-node-12-and-allow-access-via-a-path-like-co/165126#165126", which contains this rule in export format: