The help text for this plugin says: This allows you to say things like "Joe can access project A, B, and C but he can't see D."

But since ACLs are additive, you have to have special ACLs on A, B, and C in order to do this. It would be nice to have an exclude permission so one would only have to supply a special ACL for D and let A, B, and C use the default permissions.