Read only User than can block IPs/URLs

[happyj]

I have created a read-only user and want to create a Role that allows the user to block IPs and URLs if they are found malicious. I cannot find a feature in the role menu that specifies this ability. What would I set to restrict this user to only have this ability?

[PhoneBoy]

To block a specific URL or IP, that means modifying an existing object that is already referred to in a drop rule of the rulebase.
Which means they must have access to edit objects, and this is a global permission (either they can edit any object or none).