Restrict passwords by default

Currently, when configuring restrictions for individual passwords or password folders, access is allowed by default.

It would be very helpful to have an option to set certain groups to deny access by default, then explicitly allow access as needed.