"Negative permissions have consistently been regarded as bad practice and often treated as theoretical concept...If you find yourself reliant on them, consider one of the following actions: Restructure your permissions into proper allow rules; this is the most recommended approach."
This resonates. Negative permissions can be a real footgun, which is why we are being very surgical on if/where to introduce them at Oso[1]