How to create a read only role for AP based on buisness unit

Summary:

Content (required):

Anyone create a custom AP role that only has read only access for the granted business unit.

Thanks,

Version (include the version you are using, if applicable):

Code Snippet (add any code snippets that support your topic, if applicable):