Limit access by API proxy to specific admin/config objects?

[guycrets]

A proxy can by default access all objects in a single environment: KVM's, Caches, Target Servers...

Q: is there a way to limit access by an API proxy to specific admin/config objects?

Context of my question are multiple teams working in a single tenant:

• Through RBAC, it is possible (but not trivial) to restrict access via Edge UI or Management API.
• But any API proxy can access all admin objects in its environment. E.g. a proxy of team B can directly access team A's caches or (environment) KVM's
• For KVM's, there is ultimately the option for proxy specific KVM's. But not for caches a.o. Neither shared flow specific KVM's.