console rw access control

I'm migrating from consever 7.2.x to 8.0.x and I'm having some trouble
figuring out the configuration syntax for the access control that I was
doing before.

My 7.2.x conserver.passwd file looked like this:

abc123:*passwd*:aleph
*any*::any

So abc123 only gets access to "aleph" and everyone else gets access to 
all consoles.

My configuration for 8.0.x looks like this:

default * {
	logfile /var/log/consoles/&;
	master localhost;
	type host;
	timestamp 1la;
	rw *;
}
console aleph {
	host terminalserver;
	port 2001;
}
console alfalfa {
	host terminalserver;
	port 2002;
}
console almond {
	host terminalserver;
	port 2003;
}
access * {
	trusted localhost;
}

Is there a way to negate "rw", so abc123 is denied access for all 
consoles except aleph?

Thanks.