This table shows some problem cases where capabilities are not resolved correctly in the current perf branch.
Example to reproduce one combination:
Add a user as a normal student to a course
Add a forum to that course
Create a new role called "Bad student" that contains PREVENTS (eg PREVENT mod/forum:viewdiscussion)
Give the student the "Bad student" role in that forum
The prevents are not applied as expected and the student can still view discussions etc