Something like this:
New setting called "*deny". When you can't read a card, you look for its *deny rule and render that instead.
If you're rendering a :read view, then you render the deny card in the current view. If you're in an edit view, you render, what...content?
Note that you could have a chain of *deny views. Eg, there's a card called Super Secret of type Clandestine and a card called Kinda Secret of type HushHush, and you have these rules:
- Clandestine+*type+*deny -> Kinda Secret
- Clandestine+*type+*read -> Top Clearance Role
- HushHush+*type+*deny -> Public Page
- HushHush+*type+*read -> Anyone Signed In
Working like this, we should be able to get rid of our deny view...