1. A computer-implemented method for managing a directory server, the method comprising: creating an object class to which a nested EXCEPTION role comprising at least two constituent roles belongs, the object class defining the nested EXCEPTION role as a result of a logical operation on each of the constituent roles in the nested EXCEPTION role, the nested EXCEPTION role declaring itself as a member of the object class without indicating the logical operation; defining a plurality of entries in the directory server, at least one of the plurality of entries possessing the nested EXCEPTION role by possessing none of the constituent roles in the nested EXCEPTION role; querying each of the entries to determine whether the entry possesses the nested EXCEPTION role by performing the logical operation on a plurality of results, each result indicating whether the entry possesses a corresponding one of the constituent roles of the nested EXCEPTION role; and in response to querying, providing entries that possess the nested EXCEPTION role to a client.