View Only User - How to

Using ver 13, is there an easy way to create a view only user like for auditors who can view everything, but change nothing? Only way I can see now is creating a new role and for EVERY doctype adding a rule. There would seem to be a better way leaving doctype blank so applies to all, but doctype is mandatory.