this allows you to define a group deny policy that can be overridden on a per-user basis. This is a backward incompatible change Signed-off-by: Nicola Murino <nicola.murino@gmail.com>