You'll notice
A command headed for an ask prompt can now be flipped straight to deny when a deny rule matches it.
The ask-rule resolution helper used for permission prompts now also checks deny rules across the same candidate command set, and can flip an 'ask' decision straight to 'deny' when a deny rule matches, instead of only ever finding which ask-rule applies.