Read only App Designer access

We have a requirement to grant read only access to app designer to a small group of users.

For the most part, setting a primary permission list with the definition security installed and some options flagged/unflagged ("Read only") on the PeopleTools tab of the permission list, seems to work.

However, it is still possible for a restricted user to create his own tools objects.

(Since that user cannot create tables or views on the DB, he would be limited to use the existing table definitions on pages etc.)

Rename and delete for existing (secured) objects doesn't work, "save as" does.