Something like this:

New setting called "*deny".  When you can't read a card, you look for its *deny rule and render that instead.

If you're rendering a :read view, then you render the deny card in the current view.  If you're in an edit view, you render, what...content?

Note that you could have a chain of *deny views.  Eg, there's a card called Super Secret of type Clandestine and a card called Kinda Secret of type HushHush, and you have these rules:

• Clandestine+*type+*deny -> Kinda Secret
• Clandestine+*type+*read -> Top Clearance Role
• HushHush+*type+*deny -> Public Page
• HushHush+*type+*read -> Anyone Signed In