[resonantjacket5]

It seems pretty similar to how aws access controls work. By default everything is disallowed. Then you can gain more permissions explicitly. But an explicity deny overrides all explicit allows