I believe this is for when you have concrete exceptions to a wildcard, but @Joey can say for sure, like if you had

(allowed - denied)

and

document:123#allowed@user:*

and

document:123#denied@user:jake