Structure it from the perspective of the current user. Privacy rules do not work for look ups. Also, do not forget that the furthest-low box is also important to setup, as this is where you restrict access to everybody else.

Please see below … an example to provide access to a thing called “application” only to paid users … from the perspective of the current user: