@akshaybhujbale That's expected behaviour - when you update ACL's those are stored under node as respective node as rep:policy as you see below and that's reflect in response of json
The permission model comes with the additive & inheritance model i.e.
If there are multiple groups assigned to the user the combined permission will be applicable to the user, and
if there is permission on the parent group then that will float to its child group.
Permission over here are applied as:
Implicit = Indirect
Explicit = Direct
Now if you are unchecking any checkbox over here, that means you might be overriding the permission coming from the parent group. And, therefore having the "DENY" permission states that over here the permissions are removed explicitly from that group/user.
In addition to what @santoshsai has explained, if you want to remove deny you can go to Touch UI permissions page : /security/permissions.html/principal/everyone and delete the deny permission.
I am not sure what URL you are using to get JSON but to avoid rep:policy in JSON response, you can hit model.json of the page(eg /content/we-retail.model.json ) or jcr:content.infinity.json(/content/we-retail/jcr:content.infinity.json)
@akshaybhujbale That's expected behaviour - when you update ACL's those are stored under node as respective node as rep:policy as you see below and that's reflect in response of json