I have some specific use cases for read only roles as well.  I don't want those users to really even see the details other than clients names and returns.  Having them get access to bank account numbers is not ideal.  So, read only with heightened security around data in the return.

Also, can we just get better details about what roles allow what?  The details on the site are so opaque.