Minimum role for setting a lookup-field

I have some fields that are lookups to other entities. Lets say I have a Allergy-entity, so that when creating a new contact i can select what allergy

a user has.

Now, as an admin user I have no problem setting the field Allergy when creating a new allergy. I can also see the "list" Allergies. But non-admins can do neither.

What security role do I have to give users to be able to set my  lookup-field? Or should I set some security-related property on the entity? How?

Ideally all users should be able to set allergy -property, but only admin should be able to add new allergies

Thanks a bunch in advance