If normal operations expect to be able to use different namespaces to test branches, creating namespaces etc, then bringing your own RBAC can't help.