Let's consider both the general and the specific problem.
In general the advice is usually to avoid negatives in names. The reason being: you note that it can be confusing to negate a thing; well, sometimes you have to negate a thing, and it is very confusing to negate a negative:
if (!product.NotTaxable) ...
In the specific case you mention there is specific advice. Your proposal has usability problems that have security implications, in at least two ways.
First, in most security systems you want to default to the secure mode, not the insecure mode. That is, you say "access is disallowed by default; having a permission granted is special, and allows access". You do not say "access is allowed by default; having a permission denied is special, and disallows access". So you want to design your code in the same way, to emphasize this.
Second, many security systems do not have a "binary" relationship between "granted" and "denied". That is, just because a particular permission is granted, does not imply that it is also not denied!
Imagine for example a permission system that grants access to the resource to the accounting group, but denies access to employees on vacation. Bob is an accountant on vacation; he is both granted access AND disallowed access, and now you have to decide which one wins. Again, probably you want to default to the secure mode and disallow access.
Or imagine a permission system where there are three kinds of rules: some grant access, period, some deny access, period, and some say "I don't apply to this situation". You make a priority list of rules and you run down it until you get the first grant, in which case you're done, or the first deny, in which case you're done. Here again we have the property that "not granted" and "denied" are very different.
The important thing is not whether you are avoiding !s, but rather that your APIs are very clearly and correctly expressing the logic of the business domain. That's the real readability concern.