Deny a role in root to everywhere as default and allow it to a specific location

 i want to deny a role access to all page in root except where i explicitly allow the role such as booksearch.aspx.what <location> tag is needed for this?
...