How can we design a module-specific, setup-only Application Implementation Consultant role?

Summary:

We need to redesign the Oracle Fusion Cloud Application Implementation Consultant role into module-specific, setup-only roles using a least-privilege approach.

Content (please ensure you mask any confidential information):

The requirement is to provide access only to the relevant setup tasks for a particular module, without granting transactional access or access to setup activities belonging to other products.

We created custom roles with a limited set of module-specific setup privileges. However, during testing, users can access additional tasks even though the corresponding privileges do not appear to be directly assigned or inherited through the role hierarchy. We are unable to identify which security component is providing this access.