[philipov]

The more I think about it, the less I understand why you'd ever need to explicitly block permissions. Permission groups are a good idea, but since the interviewer said it's not a data structure or algorithm question, I think it's trying to elicit problem analysis from the interviewee. What are the use-cases for blocking permissions? Why can't you just refactor the tree so that all assignments are allow? Using a mix of allow and deny is convoluted.

It seems like a trick question designed to see if the candidate is willing to question assumptions.

[resonantjacket5]

It seems pretty similar to how aws access controls work. By default everything is disallowed. Then you can gain more permissions explicitly. But an explicity deny overrides all explicit allows