Having Add+Subtract moves the system into a whole range of potential conflicts requiring resolution. At the least, the order of putting in permissions will now be significant, and so there will necessitate a reorder function to move things up/down.
Otherwise, there is no way to resolve potential conflicts when a person:
- is in more than one group
- one group is permitted access
- another group is denied access
EDIT: Or you can say Add always trumps Subtract, or vice versa. Nevertheless, it makes things very hard to understand.
Although I can understand the pain you’re going through in order to request this… I have tons and tons of groups and each category’s permissions list is like 15 long, just to do what you’re looking to do – that is, to exclude a particular group from access while opening to most others.