IMO Global auditors should have read access to all templates but shouldn't necessarily be able to create workspaces. I'm in favor of future custom roles that actually disallow users (maybe a restricted auditor) from creating any type of workspace.

Let's research how other products treat the "auditor" role before committing to a specific solution, though. My mind jumps to "readonly access to everything, but shouldn't be allowed to create cloud infra," but there are other platforms we can validate with (e.g. Hashicorp Cloud).

We should be distinguishing between "read" and "use" verbs. They are clearly different things and conflating them is a root cause of this issue.

@spikecurtis agreed