Hi,
You may need a new class for this:
https://kb.juniper.net/InfoCenter/index?page=content&id=KB23038&actp=search
Example:
> show configuration system login class op permissions [ clear network reset trace view view-configuration ]; allow-commands show; deny-commands "(request)|(start)|(set)"; allow-configuration show; deny-configuration all;
Cheers,
Ashvin