So you want item A1B1C1 to only be accessible by RoleA1B1C1? First thing would be this, I'm assuming that RoleA1B1C1 is inheriting RoleA1B1, and then RoleA1B1 is inheriting RoleA1. Otherwise, depending on your other security, RoleA1B1C1 might not be able to see the ancestor items.
So there's a few assumptions going into this, but if I understand your scenario:
- In the Security section for the item, add the Everyone role and set the Inheritance settings to Deny on Item/Descendants.
- Then add the RoleA1B1C1 role and grant Read to Item/Descendants. Note for a quick example, I'm using the sitecore\Developer role, but use your custom role here.
This breaks the inheritance chain so that you have to be a member of that one role to access the item, without explicitly locking out the other roles. If you explicitly deny the other roles, anyone in both RoleA1 and RoleA1B1C1, for example, would be denied access to the item. This way, if someone's crossing roles, they'll have access to the appropriate content.