Allow the prevention of individual perms on a specific user, rather than have deny it for all the roles they obtain

One specific example was a problem user who kept giving themselves inappropriate nicknames, but due to internal server politics they could not be reprimanded and we just had to keep changing their nickname back. An assignable role or a user option that would prevent an individual user from such perms, while overwriting the ability of other roles to give such a perm would be ideal to deal with such situations. Instead of denying the ability to rename or other such perms for every role they have and as such every other user within just those roles (as currently a single role with such perms allows them to do it) this would allow other users to continue as normal while enabling better moderation.