Register negative permissions first

In SQL, negative permissions are assigned in an arbitrary order - this
forces negative permissions to be assigned last on each inherited level.