code: def get_disallowed_permissions_for(brain_or_object, user=None):
      
      disallowed = []
      user = get_user(user)
      obj = api.get_object(brain_or_object)
      for permission in get_mapped_permissions_for(brain_or_object):
          if not user.has_permission(permission, obj):
              disallowed.append(permission)
      return disallowed
docs: Get the disallowed permissions for the given object
  
      Code extracted from `IRoleManager.manage_getUserRolesAndPermissions`
  
      :brain_or_object: Catalog brain or object
      :param user: A user ID, user object or None (for the current user)
      :returns: List of disallowed permissions