Custom roles

Hello , I need help please, with the following challenge regarding roles and privileges when the access is given based on custom roles. There are certain cases where HR teams don't want to give a specific user access to for example, the line manager dashboard or another functionality. But when we get to come to actually finding what very specific permission or privilege triggers access to that functionality, not able to identify it .

I would like to understand what the best practice approach would be for a customer to identify what is triggering what, what privilege is triggering what functionality in respect of if it is a customer role or not, because my understanding is that custom roles are a collection of Oracle permissions and you can't change permissions, so there must be an Oracle seeded permission somewhere, triggering that functionality. We need to identify that specific privilege and remove it from all the roles and add the custom role instead.