ACL rules should support overlapping allow/deny

[mvorisek]

here is example of SQL server handling https://docs.microsoft.com/en-us/sql/master-data-services/overlapping-model-and-member-permissions-master-data-services?view=sql-server-ver15