[Zope] Preventing acquiring a permission

[John K. Hohm]

I am using Zope 2.5.1, and writing a product with a folderish class.  I want to
be able to prevent acquiring a permission from one role, while still acquiring
it from another role (if the user gets that role locally).  I suppose it could
work by preventing the user from acquiring a role; is there already some
sensible way of doing that?

It seems like the concept of assigning a permission or role to a user at an
object but not at any of its contained objects would be generally useful.