Role with Create Privileges but No Delete, or Deny Delete

We've recently run into issues with users accidentally changing a setting or deleting a device and would like the ability to allow users to Create new devices, but not be able to delete anything or change alert settings.

I'd like to either split Manage into Write/Delete groups or add a deny action role that would allow me to give users manage access with a deny delete:*