Inheritance & overrides

• Allow (✔): grant the action.

• Neutral (•): no change; inheritance decides.

• Deny (✖): explicitly block, overriding any inherited allow.

Deny overrides Allow. admin cannot be denied.