Partial RBAC in a pack.

Hi team, I was wondering if there is such feature in the current rbac system and if not, I wanted to see what should be correct workflow to achieve the goal.

Suppose I have a pack. Admin has full access to the pack and observer can only view the pack. There is a role between observer and admin (let's call it the 'contributor'). Contributor has most of the access in the pack but still needs to be restricted from 1 action, which is to delete an app. As an admin, I don't want a contributor to purposefully nor accidentally deletes it but still give the contributor access to the majority of the actions in the pack.

In the current document, I don't see a way to negate access that's already given in a simple manner. Is this possible?

Start by reviewing the current RBAC documentation and the pack permission workflow described in the issue. Determine whether a contributor role can deny app deletion while retaining other pack actions, and establish the supported workflow or required design for that scenario.