I am trying to give full read-only access to my APICs to an auditor, and I assigned them the "read" permission to the security domain "all" with the cisco-av-pair string "shell:domains=all//admin". However, this does not allow them to see the "System -> System Settings" menu item. If I grant them the write permission to that same role "shell:domains=all/admin/", then they do see it. But how come it is hidden if it is read only? Is it not possible to change this?
