What's the recommended way to define an app-specific user attribute?

We want to allow our customer's Okta administrator(s) to specify three levels of user access to our application without creating three copies of our OIN app, one for each:

1. admin
2. read-write
3. read-only

I've looked into custom user attributes and I like the idea of defining an attribute as an ENUM, so we can find the attribute and be confident that it will have a fixed set of values.

Is a user attribute the right solution? If so, can an existing attribute be used, or is a custom attribute called for?

If a user attribute is NOT the right solution, what's commonly used?

Thank for your time,

Dorsey