RTC user access management

my client proposes to have a custom RTC role called "RTC_AccessAdmin" with specific RTC permissions used exclusively by projects to add/remove and change roles at RTC Project or Team Area level. That works well but there is one issue, let me explain.

In total there are around 5 different RTC custom role defined .i.e RTC_AccessAdmin, Stakeholder, Developer, Project_Admin and ReleaseManager.  the custom Project_Admin role is designed to be role with greater powers which we don’t want someone  with RTC_AccessAdmin role to assign another user.  

In simple terms, A user with RTC_AccessAdmin role should not be allowed to assign another user with Project_Admin role.

I cant see out of box way to specify above pre-condition restriction. Is it possible to implement custom pre-condition via a process template change ? or will this require a custom plug-in deployed on the server side  ?

Any suggestions and tips appreciated.