Creating new roles

[richard -rw- weinberger]

Hi!

What is the preferred way to create new roles?
I'd like to create a role like sysadm_r but with less rights.
Do I have to patch the selinux-policy rpm?

Is somewhere defined (in written text) what exactly the current roles
are allowed to do?
E.g. user_u seems unable to see system processes. Where can I read
more about such
limitations?

-- 
Thanks,
//richard