I would like to be able to deny the ability to push to a branch or set of branches. To do this now, I have to set the repository or global permission to read-only, and then add branch permissions for every other branch. I would be easier if I could set the repository permissions to read/write, and then add a branch permission that denies write access to a branch or branch pattern.

The use case is that I have a set of branches that are used for importing changesets from our old TFS VCS. I don't want people to be able to push any commits to those branches, (which are named tfs-history/*), because that would break the system for bringing in additional changesets from TFS.