Are asking can you implement something when you assign a User to a Security Role? or how to stop once assigned?
For Assigning a Security role it could be done via a plugin.
Usually to implement separation and segregation of data,
a) System Administrator is not assigned to general users (only other way is to implement plugins on retrieve and retrievemultiple - I do not recommend this, and users with the System Administrator role can work around it if they really want to by disabling the plugin steps)
b) Implement a Business Unit Structure, and the BU Structure in combination with your Security Role Privilege levels and record ownership allows the separation and segmentation.
