The systems that I've seen of this nature have been rules-based, like this:

if A allow, else continue to next rule

if B deny, else continue to next rule

if C allow, else continue to next rule

deny all

For example, ufw rules have that form.

I see a few advantages compared to Boolean operators:

1. Easier to diff and version control.

2. Easier to build UI for, for example, to show which rule fails for a particular user.

3. Simpler to implement, no recursion in the DSL.

4. Arguably simpler to use.

5. Immediately obvious how short-circuiting works.

Why did you choose to go with Boolean operators rather than rules?