System administration>Security>Securityconfiguration

Click Unpublished objects

Add unpublish button in the "Unpublished objects form"

We have client scenarios where roles/duties and privileges may be changed but then realize they are not needed before publishing them. There needs to be a way we can unpublish the changes in the UI so we do not have security sitting out there in the unpublished objects form.