Creating our own customized roles

Would be great to be able to create our own custom roles so that I can give access to someone, where they can see leave, get notifications of leave (approve leave if possible) but NOT have access to the sensitive performance information. 

Currently, when giving access to someone to only approve leave, this employee is given the team manager role which seems to have access to the performance info which can be avoided if we had the chance to customise our own roles by restricting access to certain areas of the application.