Is there a way to limit access to Designer/SyncEditor to Read-Only for System accounts?

Hello Experts,

I have a bit of an issue and looking to see if there is a solution.  Currently we are using OneIM 8.0.1.  Our whole team has System Accounts due to need for provisioning in manager.  I was wondering if there was a way to create custom roles that provides specific access to specific modules.  I want to make sure the team has full access to Manager but read only access to other modules like Designer or SyncEditor.  How hard/Easy is to create custom roles that gives these permissions.  Is there any documentation on it?  What we are trying is to have one or two admins with full access and rest of the team with limited access.

I sure would really appreciate your assistance in this matter.

Thank you,