Access Control: Make it possible to exclude role grants (#91647)

pkg/api/accesscontrol.go

@@ -442,6 +442,8 @@ func (hs *HTTPServer) declareFixedRoles() error {
 			},
 		},
 		Grants: []string{"Editor"},
+		// Don't grant fixed:folders:creator to Admin
+		Exclude: []string{"Admin"},
 	}
 
 	foldersReaderRole := ac.RoleRegistration{

pkg/services/accesscontrol/models.go

@@ -26,8 +26,9 @@ var (
 // RoleRegistration stores a role and its assignments to built-in roles
 // (Viewer, Editor, Admin, Grafana Admin)
 type RoleRegistration struct {
-	Role   RoleDTO
+	Role    RoleDTO
-	Grants []string
+	Grants  []string
+	Exclude []string
 }
 
 // Role is the model for Role in RBAC.