title: Mercurial ACL, possible to grant a group permission to one branch but deny everything else?
body: <p>Basically</p>
  
  <pre><code>[acl.groups]
  group1=user1,user2
  group2=user3,user4
  
  [acl.allow.branch]
  default=*
  
  [acl.deny.branch]
  *=@group2
  </code></pre>
  
  <p>Since Mercurial looks at deny first, it ignores acl.allow...our repo has many branches which are labeled with ticket numbers.  I can't possible deny each individual branch (and wild card matching on branches do not seem to work)</p>
  
  <p>I would like to deny every branch to group2 but default</p>
  
  <p>Is this possible?</p>