Restricting user access rights to the BIGIP

Hi,   I am looking for a way to let a customer have SSH access so that he can:   + see bigtop staticstics   + view logs   + run TCPDUMP & SSLDUMP   + but, DO NOT want him...