This may be totally outside the design philosophy of spicedb but I actually really like the high-impedance metaphor (Z) from electronics. Y+N=exception, but Y+Y=Y, N+N=N, Z+Y=Y, Z+N=N. This is in the case where you'd query two permissions and combine them.