Allow access if the user has at least one group, and has no one !group
E.g.: groups="a,!b,c,d,!e"
(a, c, b) prevent access
(c) allow access
So the negative groups have precedence.