Add Worklog Entry but not be able to edit requests

Add Worklog Entry but not be able to edit requests

Is there a way to allow a technician to enter worklog entries into requests but NOT be able to edit requests? The particular user has SDGuest access. 
I've been playing with the roles to see if I can build a custom one but I can't give the ability to add worklog entries without giving the ability to edit requests.

Thanks,
Tammy
              New to ADManager Plus?

                New to ADSelfService Plus?