Access Control: Make it possible to exclude role grants (#91647)

pkg/api/accesscontrol.go

@@ -442,6 +442,8 @@ func (hs *HTTPServer) declareFixedRoles() error {
 			},
 		},
 		Grants: []string{"Editor"},
+		// Don't grant fixed:folders:creator to Admin
+		Exclude: []string{"Admin"},
 	}
 
 	foldersReaderRole := ac.RoleRegistration{

pkg/services/accesscontrol/models.go

@@ -28,6 +28,7 @@ var (
 type RoleRegistration struct {
 	Role    RoleDTO
 	Grants  []string
+	Exclude []string
 }
 
 // Role is the model for Role in RBAC.