SEC: Role Design

Hi community,

I'd like to ask for some advice regarding a role design intended to be used by external functional consultants.

Some facts about the actual security:

- Security types 1+3 are closed at *PUBLIC level.

- I have roles based on business process with access to JPD910 and PD910 envs.

The question is: how can I design a role that allows access to all applications except the technical ones (the apps under the GH90 menu)? This role will have access only to DV and PY, therefore SoD rules are not an issue in this case.

Thanks in advance,