There's no spelled out rule, but a definate no-no is anything that covers the face, such as Stormtrooper armor. The "no face characters" thing applies only to the parade, and then only individually named characters who Disney is covering (Vader, Leia, etc.).
If your costume is good and people mistake you for a Disney employee, security could ask you to change. They don't want Lester the Molester showing up and fondling anyone posing for pics, of course. So bring a change of clothes if you try it.
Scott