Not being able to give read-only access to certain users is a huge liability.  In our agency, the ED needs access to Quickbooks to be able to look at things.  However, not being able to keep her from making changes means that we're not able to separate the check signing role from the ability to make changes in the accounting.  This is really bad controls.  While I trust my ED to not be stealing money, we shouldn't need to trust her to not steal money.  We should have the systems in place to make it very hard to do, including keeping her from being able to make changes in the accounting system.