I have created a new user role by cloning the capabilities of the HR Manager role. I have experimented with removing the capabilities that I thought would allow read only access, but none of the obvious choices have resulted in a “view only” HR Manager role.
What capabilities can I remove (or add) that would allow this new role to have view only access to the employee HR records?