Has anyone ever tried to deny access to a group of custom fields, for particular roles/users? We have a custom-data tab that we'd like only particular roles to see. I know there's no 'deny' ACL, but I'm wondering if it can be faked through hooks.
I figure I can hide the tab using hook_civicrm_tabs, and kill any exports using hook_civicrm_export. Would there be much more to it than that? Or is this just entirely impractical, as there'll always be some way around it?
I appreciate we could flip it all around and start with a more restrictive set of permissions. Then create ACLs that allow access. But we have a lot of custom fields and a lot of different roles - so this would be a pretty big admin burden. And we only rarely need to deny anything.
EDIT: we're on WordPress, which doesn't have a 'deny' ACL available.