Privileges on subgraphs

Is there a practical example of assigning a role with privileges to create nodes but may not use labels from a specified blacklist? The operational guide is a bit abstract.