When delegating the Access Template All Objects - Full Control (or other similar full control AT's) and also delegating an explicit Deny Access Template, the expected behavior is that the Deny should take precedence over the Allow.
In certain scenarios, this is not occurring as expected. The following Denies are currently not taking precedence over the Full Control rights:
Delegate the desired rights individually instead of granting Full Control
Waiting for fix in a future release of Active Roles.