Customer accounts settings
A viewer can inspect settings while the caller-owned policy disables mutation.
Resource configuration
Identity, visibility, retention, and notifications remain application-owned values.
Administrator access required
This signed-in viewer can inspect resource settings but cannot change them.