Not sure I understand your question fully but if this doesn't support it you can tack on permission boundaries if you wish to apply a permission blacklist to a specific role. If it's account wide you can apply service control policies via AWS organizations.