Designing a database structure for a permissions system
"... the yellow tables are arrays so that every user can have multiple ..." -- Good.

Restricted access should be in the application layer.  No user should be able to write arbitrary SQL.

Dates should not be separated -- it will make inefficient to filter on a range of dates.  Anyway, where do you need "multiple dates"?

That's a lot of sensitive data; rethink storing all of it.