Well you could always give them two seperate roles - one for use case ABC and only for that use case... and then another role that fits their day to day and only has view access