Positive + Negative rules - how do they work?

Can you have both positive and negative rules, or does it assume the everything not in one is in the other? As in, if I allow "Free" access to Commenting, but nothing else, what happens?

Or do I have to manually set every single option for every layer of membership?