Not sure what you have in the Destination Address 'Allow_youtube' but what I'd do is create a copy of your default policy, then create a custom Web Filter profile for the one user with a static URL filter set to allow *.youtube.com. Possibly also an Application Control filter doing the same thing.