Denied + Granted = Denied
Denied + Not Specified = Denied
Granted + Not Specified = Granted.
Avoid explicit denies in your security model, take advantage of inheritance.
I recently did a ASUG presentation on this, but there is also a recording available from teched.