My workflow has a number of approval levels for a Loan Application based on total Loan Amount.

I have used a Routing Decision to direct the document to particular approvers based on the total amount. They all have access to the document.  I want to restrict the access to the Approval Field by using Assign Rights within workflow.

I have set Assign Rights to Deny Change Metadata for Everybody.

I have then set Assign Rights to Allow Change Metadata for Approver1.

But the Allow right does not over-write the Deny right in the workflow.  Approver1 is still not allowed to Change Metadata.

Is there any way to "un-Deny" the right once it is set to Deny in workflow?