[pcthrowaway]

A DAO could have a privileged user (voted in by the DAO of course) who has the ability to blocklist specific addresses that aren't explicitly on an allow-list. Then the DAO vote could add accounts to the allow-list.

Doing so would mean the token could be transacted, except by users who are on the blocklist and not on the allow-list. And this would prevent a privileged user from abusing the power to add accounts to the block-list. Getting unblocked at the speed of DAO is less of a concern, as long as blocked account-holders can still vote with their tokens.