Proxy user with role restriction

I need to allow a delegate to enter information on behalf of another user, however I need to restrict their access to one role once they've switched users.  In other words allow them to switch user to "become"  their manager but only allow them access to Manager Self-Service.  I'm using Proxy User but how can I limit the roles this person has access to when they switch.