[development] Fancy Node Access with OG

I'm working on a node access module to stomp all over OG's og_public grant realm. As part of this process, I am conditionally creating a grant that specifically grants no access. It appears this grant does not even get written to the node_access table. This would not be a problem, except (or so I surmise) without a "0" in the update column of that table, users that are not members of a given group can go directly to node/#/edit and make changes. (On account of the <em>edit any **** content type</em> permission. Is there some way I can simply revoke access to nodes? Why am I attempting this madness? I am attempt to skate along the top of the Spaces module.