Need a read only role for GL

Summary:

We are trying to create a custom role for our run model team. This role should only give them access to view all ESS jobs submitted by others but they should not be able to submit any of those ESS jobs. We tried with couple of out of the box view only kind of roles, but they are giving them access to submit ESS jobs. Any guidance is appreciated.

Here are the some OOB roles which we tried :

ESS Monitor Role

ESS Operator Role

We also tried with below privileges :

READ privilege on all ESS Request of all tenants