[Zope] Preventing acquiring a permission

I am using Zope 2.5.1, and writing a product with a folderish class. I want to be able to prevent acquiring a permission from one role, while still acquiring it from another role (if the user gets that role locally). I suppose it could work by preventing the user from acquiring a role; is there already some sensible way of doing that? It seems like the concept of assigning a permission or role to a user at an object but not at any of its contained objects would be generally useful.