Deny actions in custom roles

Currently, the custom role definition supports only whitelisted role actions. With the number of those constantly increasing (which is great by the way, kudos to the team!) it’s getting hard to track new ones and evaluate/adjust existing role definitions.
In this regard, would be great to have an ability to deny certain actions from the superset of allowed ones. For example, I want to give internal users ability to manage all aspects of the space, except for worker pool. Currently, the only way in this example is to maintain the custom role with curated list of actions without WORKER_POOL_ ones.