Should security roles ever negate or remove functionality or should they be additive only?

In my experience I believe that security roles in a software system where:

Should security roles ever negate or remove functionality or should they be additive only?

In my experience I believe that security roles in a software system where:

Should security roles ever negate or remove functionality or should they be additive only?

In my experience I believe that security roles in a software system where: