Yes, I have a lot of intersections and unions, but I don't really use exclusions. I have rules that look like this:

// Roles
permission guest = assignees & company->guest;
permission member = assignees & company->member;
permission admin = admins + company->admin;
permission at_least_member = member + admin;
permission at_least_guest = guest + at_least_member;

permission access = at_least_guest;

or

permission access = (task->access & project->at_least_member) + (creator & project->member);