includes/scald.constants.inc | 16 +++++++++++++---
 includes/scald.pages.inc     |  2 +-
 scald.module                 | 33 +++++++++++++--------------------
 3 files changed, 27 insertions(+), 24 deletions(-)

diff --git a/includes/scald.constants.inc b/includes/scald.constants.inc
index c419286..04181c7 100644
--- a/includes/scald.constants.inc
+++ b/includes/scald.constants.inc
@@ -57,10 +57,20 @@ define('SCALD_ADMIN_ACTIONS_BATCH_LIMIT', 1);
 define('SCALD_ENABLE_BATCH_LIMIT', 100);
 
 /**
- * Constants for hook_scald_atom_access().
+ * Modules should return this value from hook_scald_atom_access() to allow
+ * access to an atom.
  */
 define('SCALD_ATOM_ACCESS_ALLOW', TRUE);
+
+/**
+ * Modules should return this value from hook_scald_atom_access() to deny access
+ * to an atom.
+ */
 define('SCALD_ATOM_ACCESS_DENY', FALSE);
-// Let Scald decide the permission for the action, this is equivalent
-// to using the return statement without parameters.
+
+/**
+ * Modules should return this value from hook_scald_atom_access() to not affect
+ * atom access.
+ */
 define('SCALD_ATOM_ACCESS_IGNORE', NULL);
+
diff --git a/includes/scald.pages.inc b/includes/scald.pages.inc
index e6f367d..703bf40 100644
--- a/includes/scald.pages.inc
+++ b/includes/scald.pages.inc
@@ -20,7 +20,7 @@ function scald_atom_add() {
 
   foreach ($types as $name => $type) {
     // Skip atom type the user isn't allowed to create.
-    if (!scald_atom_access(new ScaldAtom($name), 'create')) {
+    if (!scald_action_permitted(new ScaldAtom($name), 'create')) {
       continue;
     }
     $content[] = array(
diff --git a/scald.module b/scald.module
index 19781fc..91023fc 100644
--- a/scald.module
+++ b/scald.module
@@ -1101,24 +1101,6 @@ function scald_invoke_atom_access($atom, $action, $account = NULL) {
 }
 
 /**
- * Determines whether the user may perform the action on the atom.
- *
- * @param $atom
- *
- * @param $action
- *
- * @param $account
- *   (Optional)
- *
- * @return boolean
- */
-
-function scald_atom_access($atom, $action, $account = NULL) {
-  $access = scald_invoke_atom_access($atom, $action, $account);
-  return $access === SCALD_ATOM_ACCESS_ALLOW;
-}
-
-/**
  * Determine the Scald Actions Bitstring for a given Atom for a given User.
  *
  * @param ScaldAtom $atom
@@ -1187,6 +1169,16 @@ function scald_user_actions($atom, $account = NULL) {
  *   TRUE if the action is allowed, FALSE otherwise.
  */
 function scald_action_permitted($atom, $action = 'fetch', $account = NULL) {
+  // Check hook based permissions first, because role based permissions are
+  // "allow-like" and therefore can not negave hook based permission.
+  $access = scald_invoke_atom_access($atom, $action, $account);
+  if ($access === SCALD_ATOM_ACCESS_ALLOW) {
+    return TRUE;
+  }
+  elseif ($access === SCALD_ATOM_ACCESS_DENY) {
+    return FALSE;
+  }
+
   $actions = is_array($action) ? $action : array($action);
   if (!isset($actions['op']) || $actions['op'] !== 'AND') {
     $actions['op'] = 'OR';
@@ -2321,14 +2313,14 @@ function scald_context_config_features_revert($module) {
 function scald_atom_add_access($type = NULL) {
   // If we got a type, check that the user can create atom of this type.
   if (!empty($type)) {
-    return scald_atom_access(new ScaldAtom($type->type), 'create');
+    return scald_action_permitted(new ScaldAtom($type->type), 'create');
   }
 
   // Otherwise, iterate over our atom types to check if there's one that the
   // current user is allowed to create.
   $types = scald_types();
   foreach ($types as $type) {
-    if (scald_atom_access(new ScaldAtom($type->type), 'create')) {
+    if (scald_action_permitted(new ScaldAtom($type->type), 'create')) {
       return TRUE;
     }
   }
@@ -2462,3 +2454,4 @@ function scald_atom_user_build_actions_links($atom, $query = NULL) {
 
   return $links;
 }
+