This section is at https://rollingedition.com/data-governance-as-code/access-policies-as-code#deny-by-default-then-allow-by-role.