An account has members, and each member holds a role.
A viewer's restriction is enforced by the database, not by hiding buttons. Somebody with a read-only role cannot record a change by any route: not through the interface, not by calling the API directly, not from a device syncing work recorded offline.
That distinction is worth stating plainly because the weaker version is common. Hiding a control stops an honest mistake; it does not stop anything else.
Within an account, a member can be restricted to particular ports. Where no restriction is recorded, a member reaches every port in the account — the restriction is something you add, not something you have to remember to remove.
Changing what a port asks for — its checks, its requirements, its custom fields, its session timeout — is an owner's decision rather than an operator's, because it changes what every future visit will be asked. Operators record what happened; owners decide what gets recorded.