In my Gerrit project I have a custom label for certain type of reviews that ranges from -1..+3. Only people from a certain group are allowed to vote on this label:

[access "refs/*"]
  label-Custom = -1..+3 group trusted_devs

What I want is to restrict the range of available votes to -1..+1 if the dev is a change owner (even if he is in trusted_devs group.

[access "refs/*"]
  label-Custom = block +2..+3 group Change Owner
  label-Custom = -1..+3 group trusted_devs

According to documentation “Allow” would override this “Block” since it is a wider group (if I understood it correctly)

Note: this is modern Gerrit server, so Prolog rules are deprecated. I can create a [submit-requirement "Custom"] which would prevent submission, but I find it confusing that you still have the option to vote in the entire range.