Custom Roles Restrictions

Hi,   Is it possible to create a custom role/resource and give a user complete access to a set of BIG-IPs (e.g Test devices) but restrict access/control to prod/DR devices?     Cheers,