CLI access for team members in a read only mode

Hi, 

i've been wondering if there is an option to create a group in your Team where you give users the option to use cli with limited access to only let it do non changing things like reading secrets/variables as from my understanding so far cli access mostly came allong with the permission to manage things.

Is there any way to do that currently as otherwise i wouldnt really know how to do that.

Kind regards,
-kiru