Positive permissions should always win over negative permission