You need to assign him to a customer group, ie staff, then look at the Access Control List to set what things "staff" can do.