Slide 40 of 57
Notes:
Negative policy precedence is needed for revocation of access rights.
More specific policies taking precedence is possibly more intuitive in many situations
Currently only implement more specific precedence but need a to be able to specify a variety of precedence relationships