Allow List vs Deny List for ACLs

Describe the current behavior

After talking this through with Marvin (https://prefect-community.slack.com/archives/C04DZJC94DC/p1788888525925399), my understanding of RBAC and ACLs in prefect is that basically entities (Users, Teams, Service Accounts) can be given roles, which grant permissions broadly. For example the Runner role can run deployments (as in all of them). ACLs can be used to restrict certain roles from taking certain actions on the resource they are specified on. Ex: "$role cannot run this deployment". That means if I have a service account granted Runner and I only want it to be able to run 1 specific Deployment, I have to ensure all other deployments have the deny ACL for it or are isolated to different work pools, etc.

Describe the proposed behavior

It would be operationally simpler to be able to say "This role can only run a specific deployment" using either tag based RBAC or "granting" ACLs (vs denying).

Example Use

No response

Additional context

No response