Role filter to allow editing "compute profile" without also allowing edit of "compute resource"?

My Org managers want to have the ability to edit compute profiles but I
want to restrict their ability to edit compute resources. I have to add
the edit_compute_resources filter in order to give this ability otherwise
the org managers get "Permission denied" when trying to edit the compute
profile. Is there some way anyone has found to work around this? Perhaps
a clue on not checking "unlimited" and some magic in there? Thanks.