User role weaker than authenticated user I am using LoginToboggan Module and I want to create to create a "pre-authenticated" user role that users get assigned to upon registration. After they have verified their email address they will be promoted to "authenticated" users. Obviously, pre-authenticated users should have restricted permissions.


  If "Set password" is selected, users will be able to login before their e-mail address has been authenticated. Therefore, you must choose a role for new non-authenticated users -- you may wish to add a new role for this purpose. Users will be removed from this role and assigned to the "authenticated user" role once they follow the link in their welcome e-mail.


I created a new role "pre-authenticated" and gave it weight 1 and "authenticated" weight 2 ("anonymous" has weight 0 and "administrator" has weight 4). However, whenever I give "authenticated" users the permission to do something, "pre-authenticated" users inherit this permission. It seems like Drupal treats all custom roles as being extra roles for users that already are authenticated. I already cleared my cache and ran cron.
This doesn't appear to be documented in the LoginToboggan interface anywhere but the default behaviour actually does what you want it to do.

You need to create new role like you mentioned, a pre-authenticated user. 
After creating the new role go to LoginToboggan config page and select this new role as your Non-authenticated role and save.
Now when you go back to the permission config page you'll see this new role is excluded from the authenticated user permissions, just like the anonymous user.