Proposal for capabilities

How are conflicting permissions handled?  If a project has a feature enabled (say ssh) and account has the same feature disabled.  When my user (attached the account) requests to use SSH, is he allowed or disallowed?