restrict user from BIG-IP ASM requests

Newbie question. I do not see any built in roles that restrict a user from BIG-IP ASM requests. Any suggestions on how to grant a user access to Big IP that has ASM module but restrict access to AS...