Read-only role — chat answers use live, read-only Vault data only (health, auth methods, policies, etc). Seal/unseal and write actions are disabled for this role.