Ability to assign a user to a read-only role

Problem Statement

I'd like to have the ability to assign some of my users to a read-only role. Ideally they would be able to query events, releases, etc, but they would not be able to take actions that update data models like resolving an issue or finalizing a release.

Solution Brainstorm

My team came across this while writing a few scripts to do some actions through the Sentry API. Specifically we were considering including an action to mark an issue as resolved through a slack bot interaction, but after some discussion we think that we don't want to give that ability to everyone, since they might not fully understand the result of that in Sentry.

Our scripts currently allow you to bring your own token and we realize that we could change that to only use an existing token from our tool (with only event:read access), but we think that a cleaner option would be to have a standard role with that type of permission.

Product Area

Settings - Members

Start in the Settings - Members area and trace how the existing event:read token permission is represented and assigned to users. Compare the permissions needed for querying events and releases with actions such as resolving issues or finalizing releases; done means a standard read-only role can perform the former while being blocked from the latter.