Setting up domination of a security role access based on page DFFs when two roles are assigned

Scenario: There are two Learning Roles: One role is intended to only view and edit learning assignments under offerings with a specific DFF value; Another role can view all learning assignments based on an AoR, but cannot edit. No restrictions based on DFF value.

Current behavior: When two roles are assigned to a user, accesses provide by both roles stack. The user can now view and edit all learning assignments regardless of the limitations set for each role.

Ideal behavior: When two roles are assigned to a user, there's a way to setup domination of a role depending on the DFF value, in which if an offering has the specific DFF value, the user can view and edit the learning assignments. But if the DFF value is different, the user should only be able to view the learning assignments.