A user-role account can execute show and other basic CLI commands.
device# configure terminal
device(config)# username jdoe role user password iKt1Sas*p