According to http://www.pmwiki.org/wiki/PmWiki/AuthUser, it's possible to make exclusions from an authorization group as follows
If you need to keep "Fred" out of this password group :
@wholeoffice: *,-Fred
I tried the above, but Fred received @wholeoffice access rights anyway. Does this feature work for anyone else?
Randy