Not everyone who accesses a system needs the ability to change it. In fact, many security incidents happen because regular accounts have more permissions than they actually require.
“Read-only” access is one of the simplest, and most effective, ways to limit damage to confidential documents.
