Combining Permissions

Hello, I'm trying to understand how to combine permissions in different roles.

Let's say that

• Role A has grant on layer 1 and denial on layer 2. 
• Role B has grant on layer 2 and denial on layer 1.
• User "Tom" has both roles

The result will be that "denials" will be summed and "Tom" will have no access to any layer. Is it possible to do the opposite? I also tryed to give explicit grant to layers, really tried all combinations of grey/green/red grants, bt results is always a sum of denials. I would like to give partial grants to different roles and then give multiple roles to a user and have grants summed.

Thank you!

Ciao - Guido