The idea is neat, and there is a certain precedent for the approach in .htaccess files and webserver path permissions.

Still, I worry about the added burden to keeping track of filenames when they get used as stringed keys in such a manner. More plainly: if I rename a file, I now have to go change every access declaration that mentions it. Sure, a quick grep will probably do the trick. But I don't see a way to have tooling automate any part of it, either.