[groups]
user-group = namedUser

blocked-group = blockedUser

#
# Default access should be read-write for all users who are not blocked.
# Blocked users will only receive read-only access.
#
[/]
* = r
~@blocked-group = rw