Revoking CREATE TABLE

Hi,

I would like a setup with the following:

Three users – one, called OWNER, that owns the tables and can drop, alter and change data in the tables; another called USER that can edit data in the tables created by the owner but cannot create new tables or drop any tables and a third user called RO which has read only access to OWNER’s tables but cannot change any data or create new tables etc.

I can grant table privileges to the USER and RO but how do I stop these two users from creating  new tables etc?

I’m creating the tables from a script so I don’t think I can easily create a schema so am relying on the public schema.

I suspect I’m missing something fundamental here :-\

All help gratefully received.

Thanks

Pif