Separate positive and negative permissions to allow for better control of inheritance.