Better wildcard support to allow negating the permission