AccessRules for controlling dashboard access permissions is 100% explicit?

[ProNotion]

I have a customer with a relatively large number of user groups for their organisation. There are certain dashboards which should only be available to one or 2 groups. If I am not mistaken, in order to achieve this we have to deny all of the other groups access. This isn't very scalable or manageable.

What might be a better idea is that if you have a collection of access rules that only apply grant permissions it should be assumed that all other groups are denied. The inverse of this could also be true.

Any thoughts on this or have I overlooked something that is already there?