Restrict access for specific user

That’s a good point. I’m not actually 100% sure.

EDIT: just tested, and they’re indeed additive. So I’m afraid your use case isn’t supported at this time.