Cool, search usually finds similar things but finding the correct words here was a chore 
. Basically a exclude rights group which always has final/top priority would be the easiest way (not multiple groups or anything too fancy).
Oh well, doesn’t sound like this will appear anytime soon if ever.
I have written two inherited + exclude permission systems in my life and while they felt quite difficult to write, once you get the logic and ordering correct they did work like a charm (and not a lot of code either). Not many people understood how either worked though . 4 levels of allowed inheritance and excluding probably requires Mensa level or something. Even when you have use cases for all levels.