Function block_grant 

pub fn block_grant(workspace: &str, person: &str, granted_by: Subject) -> Grant

The grant that keeps person out of workspace: every kind denied on the whole workspace, given by granted_by.