Test Case (based on comments)
CREATE LOGIN TEST_USER WITH PASSWORD = 'test', CHECK_POLICY=OFF;
USE TestDB;
CREATE USER TEST_USER FOR LOGIN TEST_USER;
ALTER ROLE DB_OWNER ADD MEMBER TEST_USER;
CREATE ROLE DENY_BACKUP;
DENY BACKUP DATABASE TO DENY_BACKUP;
ALTER ROLE DENY_BACKUP ADD MEMBER TEST_USER; -- Implicit DENY
DENY BACKUP DATABASE TO TEST_USER; -- Explicit DENY
GO
-- Implicit/Explicit BACKUP permissions Verification
select dp.name, p.*
from sys.database_permissions as p
join sys.database_principals as dp on p.grantee_principal_id = dp.principal_id
where p.type = 'BADB'
go
----------------------------------------------------------------------------------------
-- Above commands must be run by SYSADMIN, below must be from TEST_USER
----------------------------------------------------------------------------------------
Use TestDB;
Backup Database TestDB to disk = 'null'; -- as expected it fails due to DENY permissions
go
sp_helpuser 'test_user'; -- Yes, "TEST_USER" is DB_OWNER
REVOKE BACKUP DATABASE TO DENY_BACKUP; -- Implicit DENY can be revoked by same user while the user is DB_OWNER
ALTER ROLE DENY_BACKUP DROP MEMBER TEST_USER; -- Implicit DENY can be revoked by same user while the user is DB_OWNER
REVOKE BACKUP DATABASE TO Test_User -- Explicit DENY cannot be revoked by same user though user is DB_OWNER. It says, "you cannot revoke permissions yourself"
go