Manual:$wgRevokePermissions

Details
 allows setting permissions for user groups. allows revocation of any of those permissions. Revoking a right with  takes precedence over granting it with. If the right is revoked for even one of the user's groups, they will not have it, regardless of whether it's explicitly permitted by other groups.


 * Example:


 * Result is (when viewing Special:ListGroupRights):



This acts the same way as , except that if the user is in a group here, the permission will be removed rather than added. A good use-case for this setting is in conjunction with  and APCOND_BLOCKED to further restrict the rights of blocked users. Another use-case could be the creation of other "blocked groups" where a sysop can (via ) add a user to a group to allow them to edit pages normally, but prevent them from being able to move pages.