Some thoughts about permissions, especially deny. Why deny? Because deny is the best way to apply the principle of least privilege . When a permission is set, it shouldn't matter what client is used to access TFS, the permissions are evaluated according