Index: wp-includes/capabilities.php
===================================================================
--- wp-includes/capabilities.php	(revision 13094)
+++ wp-includes/capabilities.php	(working copy)
@@ -722,13 +722,17 @@
 			$cap = $this->translate_level_to_cap( $cap );
 		}
 
-		// Multisite super admin has all caps by definition.
-		if ( is_multisite() && is_super_admin() )
-			return true;
-
 		$args = array_slice( func_get_args(), 1 );
 		$args = array_merge( array( $cap, $this->ID ), $args );
 		$caps = call_user_func_array( 'map_meta_cap', $args );
+
+		// Multisite super admin has all caps by definition, Unless specifically denied.
+		if ( is_multisite() && is_super_admin() ) {
+			if ( in_array('do_not_allow', $caps) )
+				return false;
+			return true;
+		}
+
 		// Must have ALL requested caps
 		$capabilities = apply_filters( 'user_has_cap', $this->allcaps, $caps, $args );
 		foreach ( (array) $caps as $cap ) {
@@ -1027,9 +1031,6 @@
 function current_user_can( $capability ) {
 	$current_user = wp_get_current_user();
 
-    if ( is_multisite() && is_super_admin() )
-		return true;
-
 	if ( empty( $current_user ) )
 		return false;