Report level privileges

My organization is trying to deliver on "Self Service"

One question I have is how do we provision users to different roles? In our environment we have a BI development team, Business Analysts that support Program Officers, Program Officer, Executive Management. For the Program Officers and Executives we simply want to give them dashboard reports with filter options. For the BI Team we want full developer roles to build data foundations and create universes. For the Business Analyst, we want them to be able to build custom reports, ad hoc reports, etc for their Program Officer based on a subject area/universe. In my estimation, these are 3 different roles with unique privileges: 1) BI Developer, 2) Power User and 3) Read Only Authenticated User.

Our organization recently converted to BOBJ. I have been searching the literature and may have missed an obvious method for provisioning user roles. If you have a method/best practice for this, I would greatly appreciate guidance.