This is the standard Ordered Deny Overrides policy combining algorithm. It
allows a single evaluation of Deny to take precedence over any number
of permit, not applicable or indeterminate results. Note that this uses
the regular Deny Overrides implementation since it is also orderd.