Custom Role - Disable access to Files, Hardware and Policies

I am working on setting up a Custom role for end users to self serve market place apps.  Problem is that I can’t see where I can remove access to Polices (Image Placement), Hardware (GRU), and Files. They don’t appear to be in the action list.