Add support for 'cannot' method to explicitly deny permission and stop looking for lower-priority roles.