Right. You always start off with the default read only and then bills from there. There is an option called query where you can specify things like “vserver Test_svm” to limit the full access.

 Play and test with that. 

i worked with a customer to build a role that specifically gave them access to work on snapmirror relationships between two specific svms and it worked like a charm