Hey Cliff,
Unfortunately, there is no way to easily create a "read-only" account in NCS/Prime Infrastructure.
This is due to the way the permissions are built. The permissions a user gets depend on the Tasks it has been provided access to, and the Tasks refer almost consistently to the menu options of the application.
What you can do, is create a user role that contains only permissions for Tasks that do not involve allowing changes.
This can be done under Administration > User Roles and AAA > User Groups. Click a desired Role name and unselect the checkboxes of tasks that refer to the ability of deploying changes, like: Delete Device Access or Configure Access Points, etc.
It is not ideal, but is the closest we can do. It will be the same in case of Local or AAA users.
Luis
