In most typical organizations, the self service module is set up so users only see their own tickets. Even in the system we use here at BMC with employees all over the world, self service is configured to only see the users own tickets. In most normal situations, there is really no need for anyone to know what other users are submitting tickets about so I would recommend using that setting. This way you do not run any risk of someone adding notes to someone elses tickets. The main reason there is a setting to see others tickets is for managers or leads who need this access and may not have need for technician access to Track-It! As for making it read only, that is not currently possible but you can add a feature request under Ideas here on the community if you would like.