group permissions: parent groups "allow" should not override child groups "deny".