Armor's rule system has three tiers: hard_deny (never allowed), soft_deny (usually should not be done but sometimes reasonable), and allow (only as an exception to soft-deny, and never blocks by itself).