an Entity references as follows:
Cache ACLs by listing all denied resources, i.e. those the person in question does not have access to. This mode is useful in situations where most resources are public.