Role-based access for a small team

I'd like a read-only login for a colleague who watches drops but shouldn't change engine settings or submit. Right now it's one shared login.