# Security - negative rights (how?)

**URL:** <https://meta.discourse.org/t/security-negative-rights-how/303817>\
**Category:** Feature\
**Created:** [April 15, 2024, 7:39am UTC](https://meta.discourse.org/t/security-negative-rights-how/303817 "2024-04-15T07:39:27Z")\
**Posts on this page:** 1\
**Showing post:** 8

<div class="post-metadata">

**Author:** ![Peter\_Backgren](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/peter_backgren/32/66263_2.png) [@Peter\_Backgren](https://meta.discourse.org/u/Peter_Backgren)\
**Post date:** [April 15, 2024, 6:06pm UTC](https://meta.discourse.org/t/security-negative-rights-how/303817/8 "2024-04-15T18:06:50Z")

</div>

Cool, search usually finds similar things but finding the correct words here was a chore 🙂 . Basically a exclude rights group which always has final/top priority would be the easiest way (not multiple groups or anything too fancy).

Oh well, doesn’t sound like this will appear anytime soon if ever.

I have written two inherited + exclude permission systems in my life and while they felt quite difficult to write, once you get the logic and ordering correct they did work like a charm (and not a lot of code either). Not many people understood how either worked though . 4 levels of allowed inheritance and excluding probably requires Mensa level or something. Even when you have use cases for all levels.

---

_[View the full topic](https://meta.discourse.org/t/security-negative-rights-how/303817)._