Answer
Granted package/method execution privileges are stored in one table, and explicitly revoked package methods are tracked in a separate table — treat these as two distinct tables to check (grants vs. explicit revocations) rather than expecting one single table to represent a role's complete effective access on its own.