Enrollment attributes can be set to Required, Optional, or Not Permitted. However, "Not Permitted" doesn't appear to do much (and the attribute still renders when initiating an enrollment flow).

Minimally, "Not Permitted" attributes shouldn't render as part of a petition. (What about for viewing existing petitions if the attribute is changed?) Additionally, "Not Permitted" should perhaps become "Disabled", and should render as such when viewing the list of attributes defined for an enrollment flow.