That's already in place. I personally use the Web Console as a read-only tool, but it's hard to keep a manager with past developer background away from poking around - policies are for the mere mortals! :)