Question about AllowUsers and AllowGroups

[Andreas]

While testing some AllowUsers and AllowGroups combinations I was surprised
to find that one cannot be used to override the other. For example:

AllowGroups administrators
AllowUsers john

If john is *not* part of the administrators group, then access is being denied.
Is this the expected behaviour? This would force me to create another group just
for ssh, something like ssh-admins.

This other excerpt works as expected, at least for me:

AllowGroups administrators
DenyUsers johnadmin

If johnadmin is part of the administrators group, he is still denied access.

This all with openssh-3.8.1p1 on Linux.