def __init__(self):
        self._roles = {}
        self._resources = {}
        self._allowed = {}
        self._denied = {}

        # to allow additional short circuiting, track roles that only
        # ever deny access
        self._denial_only_roles = set()
        self._children = {}