Allow exceptions on desk rules so that different roles each have a different restriction