document whether access can be expanded as well as restricted at lower levels

Presumably access permission can be granted at the global level on the permissions page,
then restricted using AccessControl at the content-type level, and further restricted at the node level.

However can access be expanded as well as restricted at the lower levels?

For instance, if I deny access at the global level, can I override that to grant it for a specific content-type?
Or if I deny access for a specific content-type, can I override that to grant it for a specific node?