I would like to prevent users from one specific role from publishing directly their articles. Only administrators should be able to approve these. The only choice they would ever have is to put their articles as pending or draft. Any other roles may publish if they want. Is there a way to do so without any plugin and without having to dig too deep into the code?