Ensure privilege escalation is not possible.

With the previous version, a deny() on a lower-lever resource was not
inherited when on a higher-lever resource an allow() was given.

See the updated test for more an example.