The bug was due to the fact that the way overwrites work is by doing
a loop of all the values and then applying deny first and then allow.
That way the overwrite is defined if role A and role B deny a
permission but role C allows it (and said member has A, B, C roles)
then the resolution should allow it rather than deny it regardless of
the order of the data it is received in.