Business Central should offer more fine-grained customization of workbench access feature beyond what is currently available through "workbench-policy.properties"

Issue

• Users are currently looking for a way to restrict certain functions and pages based on roles in BPM Suite. According to the docs, the following roles are currently defined in BPM Suite.

Admin role - This role is meant to provide any user given it with full and complete access to all areas of the product.
Developer role - This role provides full access, except to the Administration perspective where you manage project and organizational setup.
Analyst role - This role provides the same access as the Developer role, except for no access to the asset repository and deployments.
User role - This is the role designed for the user of your system who is only allowed to manage processes, tasks that are generated for them, and view the created or provided reporting dashboards.
Manger role - This is the most restrictive role where we allow the user to view Business Activity Monitoring data in the form of provided or created reporting dashboards.

There are requirements from users that the Analyst users (just for an example) to be able to use the Project Authoring page to modify (add and edit) items within a project, but not necessarily to create new projects or modify the existing project (add new dependencies, change the pom info, etc). Someone would also like to be able to remove certain features from view (ex: New Item >> Decision Table (Spreadsheet)). There does not seem to be a way to do this in the current UI or through the documentation.

• The documentation talks about a way to remove a whole page (ex: Authoring >> Project Authoring) via editing the following file: $JBOSS_HOME/standalone/deployments/business-central.war/WEB-INF/classes/workbench-policy.properties, but that doesn’t help when the target users need to be able to access the page, but not all of the features on the page.

• Is there a way to achieve such a fine grained customization within the UI or the configuration for the application?

• Business Central users want to configure a custom read-only role who can read rules but cannot update the rules (and other assets) .