disable the publish button for a subset of users while still allowing them to edit the content?

Yes, this is absolutely possible! You can customize document actions to disable the publish button for specific user groups while keeping edit permissions intact. Here's how:

The Solution: Filter Document Actions Based on User Roles

You'll need to customize the document actions resolver in your Studio configuration. The key is accessing the currentUser from the context that's passed to your resolver function.

Here's a practical example:

// In your sanity.config.ts or sanity.config.js
import {defineConfig} from 'sanity'
import {PublishAction} from 'sanity'

export default defineConfig({
  // ... other config
  document: {
    actions: (prev, context) => {
      const {currentUser, schemaType} = context
      
      // Check if user has a specific role (adjust to match your role names)
      const isRestrictedUser = currentUser?.roles?.some(
        role => role.name === 'editor' || role.name === 'contributor'
      )
      
      // If restricted user, filter out the PublishAction
      if (isRestrictedUser) {
        return prev.filter(action => action !== PublishAction)
      }
      
      return prev
    }
  }
})

How This Works

The actions function receives two parameters:

• prev - the default array of document actions
• context - an object containing currentUser, schemaType, and other metadata

The currentUser object includes the user's roles, which you can check against your role definitions. You can then filter the actions array to remove PublishAction for specific users.

More Granular Control

You can make this even more sophisticated by combining user roles with document types:

actions: (prev, context) => {
  const {currentUser, schemaType} = context
  const isEditor = currentUser?.roles?.some(role => role.name === 'editor')
  
  // Only restrict publish on certain document types
  if (isEditor && ['article', 'page'].includes(schemaType)) {
    return prev.filter(action => action !== PublishAction)
  }
  
  return prev
}

Important Notes

You're correct that the core role-based permissions system in Sanity focuses on read/write access at the dataset and document type level. However, document actions operate at the Studio UI layer, giving you this additional control point.

Keep in mind: This approach hides the publish button in the Studio UI, but users with write permissions can still technically publish via the API if they have the appropriate dataset permissions. For true enforcement, you'd need to combine this with proper role configuration at the project level to ensure restricted users don't have publish permissions on the dataset itself.

The document actions customization is perfect for creating editorial workflows where some users can draft and edit content, while others (like admins or publishers) handle the actual publishing step.