Are you able to provide a more detailed example for their expectations? If I am understanding correctly it sounds like the customer wants to limit the ability for certain users to run different types of crud operations to ISE. What are you using to run them through? When you enable ers APIs in ISE it allows read/write on PAN and read only on other nodes (PSNs). My suggestion would be to create separate users. One with ers admin for read/write folks. One with ers operator for read only. Good luck & HTH!
