* changes: Rewrite permission evaluation RefControlTest: BLOCK aggregates all the forbidden votes across projects