Read only access

Hi there,

Does anyone know if it's posible to create a role/access which has 'read only' and would be able to do reports?

I have a use case for a couple of users which should get full access for reporting purpose, directly in the system (ACS) but they should not be able to modify any campaign, profiles nor other data.

Thanks for your help.