To create custom web roles, you may be able to simply reuse the existing secured actions in the Web Administrator. Using the existing secured actions allows you to make quick customizations without a build and deploy from the Application Architect.
Let's take the example of the out-of-the-box Standard User role. The first step is to take inventory of the actions for that role. To create our custom "Junior Sales" role, all we need to do is recreate the Standard User role, but omit the actions for Entities/Account/Add, Entities/Account/Delete, Entities/Contact/Add, and Entities/Contact/Delete. (Instead of 55 actions, our custom role will only have 51.)
After you create the new "Junior Sales" role, you can apply it to a user profile. Make sure you remove the "Standard User" role from the user's profile so that the roles don't overlap.
That's it! No build and deploy necessary. The next time the user logs on, he will no longer have the ability to add or remove contacts and accounts.
Check out the following video for more detailed step-by-step instructions: