I need to prevent certain roles from publishing sub-items.
I was able to hide the 'Sub-items' option in the publish dialog by revoking 'Read' from '/sitecore/system/Settings/Security/Policies/Publish/Can Perform Republish' under Core DB.
However, if the last time that user published with the sub-items 'checked' it will still publish with subitems even after revoking the 'Can Perform Republish'.
So the option is hidden but its value is still checked!!! Is this expected or is it a bug in Sitecore?