How can I create a user with read only access?

[Laura Casanta]

Can someone please tell me how to create a user that only has read access and cannot make changes to any projects/tasks.  

Also, can this read-only user only have access to specific tasks?

Thank you in advance. 

[Joe Pitt]

No. Out of the box JIRA gives everyone access, a VERY bad model. 

JIRA works by GRANTING access. You can't restrict access. By default, it grants access to the group used to logon (used to be JIRA-users but may be different on your version).  This is probably where you're getting the access from.

1. The FIRST thing you need to do to get control is to remove any groups with logon privileges from the permission scheme unless you absolutely want everyone to have that permission.
2. Then I suggest you setup Project Roles for the various functions like, tester, QA, Browse Only, etc.
3. One permission scheme will cover almost all projects. The project admin controls project role membership

This may be a big effort, but it will payoff down the road by making it easy to control access.

You can use issue security schemes to control access to issue. It is usually used to restrict access to groups or roles. You'd have to put the users in a role.