Feature Request: Assign resources to "permission groups"

In my current project we have a number of resources (application environments) that are manually reserved by developers when they want to test something.
(yes, no containers here, but that is not the point ;-))
We also have other resources that _are not meant_ to be reserved by developers, only by pipeline builds or admins.

Right now I can only grant reserve/unlock permissions to developers but I cannot "protect" specific resources from being reserved/unlocked.

It would come in handy if there were at least two different "levels" in terms of permissions.
The simplest solution would most likely be a flag _per resource_ like "protected" (or similar) in combination with a new set of permissions like "Unlock protected" etc.