I think @Quasy may have provided a definitive list of permissions that the out-of-the-box Reader role grants in this thread: Graylog Reader User
Still not sure how to provide strictly role-based permissions instead of tailoring each user stream-by-stream, feature-by-feature.