}
		if len(or) > 0 {
			permissions = append(permissions, permissionOr(or))
		}
	}

	if r.extended != nil {
		if len(r.notValues) > 0 {
			p, err := r.extended.extendedPermission(r.key, r.notValues, forTCP)
			if err := r.checkError(action, err); err != nil {
				return nil, err
			}
			if p != nil {
				permissions = append(permissions, permissionNot(p))
			}
		}
	} else {
		var or []*rbacpb.Permission