class Not(CompoundPredicate):
    '''
    A compound predicate that evaluates to false
    if its sub-predicate evaluates to true.
    '''
    error_message= "No predicates were able to grant access"

    def eval_with_object(self, obj, errors=None):
        '''
        Return false if any sub-predicate evaluates to true.
        '''
        for p in self.predicates:
            if p.eval_with_object( obj, None ):
                self.append_error_message( errors )
                return False
        return True


@identity.require(Not(identity.in_any_group("admin", "special")))