Read-only access to environments for custom roles (allow switching, prevent edit/delete/resync)

Problem

When creating a custom role with restricted permissions (e.g. for client users who should not edit models), the role still has full edit/delete/resync access to environments. There is currently no way to grant read-only access to environments.

Current behavior

• Custom role users can switch between environments ✅

• Custom role users can also edit, delete and resync environments ❌

Desired behavior

Add a granular permission (or a read-only toggle) on environments so that a custom role can:

• Switch between environments to view/edit content in the target environment ✅

• Be prevented from editing, deleting or resyncing environments ❌

Use case

We set up custom roles for our client users so they can manage their own content without touching the underlying structure. Environment management is a destructive operation that should stay with admins only, but our clients still need to be able to switch envs to preview/edit their content.

Thanks!