I would like to find a way to make it easier as well. The complication comes from the fact that we intentionally did not build in negative permissions. Once you are granted permission you have it regardless of other roles you have.
The only solution would be to push this security concept into the application layer, which is possible just not desirable.