Declare permission that never allows anything

[mgax]

I'd like to declare a permission whose .can() method always returns False (background: it's returned from a factory function and the meaning is that some objects may not be edited/removed by anyone).

There are a couple of ways to do this:

• subclass Permission and override the method;
• crate a Need that is shared by all identites and return a permission that excludes it.

I prefer the need-based method because it retains the ability to perform permission algebra with the new permission. So then, how to add this need to the AnonymousIdentity? How about we define a Principal.get_default_identity method that subclasses can override?

[mattupstate]

@mgax I like this suggestion. There really isn't any way to configure the anonymous identity at this point.