Allen,
This cannot be controlled by the Access control. You would have to write
a Validator for the action that would check the business rules and
either hides/displays the icon for certain roles. The Customization
guide has details about the Validators (Create and associate it to the
UI Action). You may end up extending the OOTB
TeamCCActionColumnValidator TeamCCValidator classes .
There are other ways to accomplish too where you may have to create a
Server side class listening the creation/deletion of the
RolePrincipalMap objects (Link between the user, role and the team) ,
check the business rules and throw Exception when the users modify the
roles (Add/remove) that you don't want them to modify.
Hope this helps,
Raju
