The part of a permission row and of a user this module reads, so the rule can be tested on plain objects.
Optional
Deny rows subtract; they never carry the read the rule looks at.
Deny
The part of a permission row and of a user this module reads, so the rule can be tested on plain objects.