basic implementation Deny+ and Grant+ policy