Question

I want to remove editing permissions from a user, but still want them to be able to update data via approving Data Change Requests (DCRs).

Answer

To remove edit permissions (which will also hide the "Editing" button from the dropdown menu), change the user's permission to READ rather than READ/WRITE. However, with just READ permission the user will only be able to view the profile, so the user must be given DCR-specific privileges.

For the Data Change Request Review, users must be given certain roles to either be able to initiate data change requests or review data change requests.

In order to make suggestions a user needs ROLE_INITIATE_CHANGE_REQUEST and ROLE_WORKFLOW and cannot have ROLE_UI_ALL. 

• ROLE_UI_ALL has the ability to edit profiles which overrides the "Suggested" mode.
• To directly edit a user needs ROLE_UI_ALL or ROLE_ADMIN or any other role that has WRITE permissions.
• To review a data change request (and see the workflow in the UI) a user needs ROLE_REVIEWER and ACCEPT_CHANGE_REQUEST. The following specific roles and permissions need to be applied:

[{
    "role":"ROLE_INITIATE_CHANGE_REQUEST",

    "access":[
        "READ",
        "INITIATE_CHANGE_REQUEST"
    ]
},

{
    "role":"ROLE_READ",
    "access":[
        "READ"
    ]
},

{
    "role":"ROLE_REVIEWER",
    "access":[
        "CREATE",
        "READ",
        "UPDATE",
        "DELETE",
        "MERGE",
        "ACCEPT_CHANGE_REQUEST"
    ]
},

{
    "role":"ROLE_UI_ALL",
    "access":[
        "CREATE",
        "READ",
        "UPDATE",
        "DELETE",
        "MERGE"
    ]
}]

References

DCR Workflow.