If puppet reorders the list to follow the preferred ordering, then tim should correctly be denied. It's only because the deny ace appears later that tim is incorrectly allowed access.