There is the deny right that overrules allow. If an user is member of a role which has deny update on table X, the user can't update it even when he has permission allow update on table Y with role Z.
Have to check if it works for administrators. (don't think so)