This could be a mad one! - for want of a better term I would call them "Negative" roles The idea is to have Roles where Features can have authorisation revoked Specifically this is not to unauthorise features as the revoke option would only be app...