if deny_perms:
                    if 'deny_perms' not in changes:
                        changes['deny_perms'] = {}
                    if user not in changes['deny_perms']:
                        changes['deny_perms'][user] = {}