As custom roles within organizations are purely additive and the "organization member" role is both automatically assigned and also not able to be unassigned, the scope / functionality of custom roles is limited. "organization member" receives basically all permissions except some relating to dormant & prebuilt workspaces and user management:

Seemingly because of these design primitives the 'Negate' permission is used on some built in roles, i.e. "Organization Workspace Creation Ban" in order to remove permissions from users:

However the negate function is not available for use on custom roles as an intentional decision per the code comment:

The result is that custom roles cannot be created which remove permissions from those assigned to the "organization member" role, and this is a feature request to allow the use of the negate function.

A customer is attempting to create a role which satisfies the following requirements:

Cannot start own workspace
Cannot stop own workspace
Cannot modify parameters of own workspace
Cannot upgrade own workspace
Cannot reach control plane directly, e.g., can only get to application URLs
Cannot ssh into own workspace
Cannot port-forward own workspace
Cannot make API keys for self
Cannot see all the templates and options

It does not appear to be possible to create a custom role which satisfies any of these requirements, the closest option appears to be using "Organization Workspace Creation Ban" which does not satisfy most of these requirements.

If/when implemented this functionality should be available in both the CLI and UI.

Error displayed when attempting to create a role which uses the negate function:

coder organizations roles create -O=rshl --stdin < test.json
Encountered an error running "coder organizations roles create", see "coder organizations roles create --help" for more information
error: Trace=[patch role: ]
Failed to update role permissions
org="d898ad9c-63b7-40dd-a0b0-70216f783be0": org: invalid permission for action="create" type="workspace", no negative permissions

test.json:

{
  "name": "test-custom-role",
  "organization_id": "d898ad9c-63b7-40dd-a0b0-70216f783be0",
  "display_name": "",
  "site_permissions": [],
  "user_permissions": [],
  "organization_permissions": [
    {
      "negate": true,
      "resource_type": "workspace",
      "action": "create"
    }
  ],
  "organization_member_permissions": [],
  "assignable": true,
  "built_in": false
}