Hi Jason,
Pam's permission are set by EEM, and you can create a custom EEM group that meet your need. I had to do something like that on a client, that wanted some folks to only have view access to running processes.
https://docops.ca.com/ca-process-automation/4-3/en/administrating/administer-components/administer-advanced-ca-eem-security/customize-user-access-with-ca-eem-policies/customize-access-for-a-specified-user/set-up-designer-specific-folders
Checkout the documentation on this:
Customize Access for a Specified User - CA Process Automation - 4.3 - CA Technologies Documentation
I don't know exactly what you mean by view access on the software, but if you want to let a user just to see running processes (my case), you create a new application group (Create a Custom Group - CA Process Automation - 4.3 - CA Technologies Documentation )
and on process control policy, do something like this:

So My custom group is the last one, I set that anyone from this group can only monitor processes.
#eempermissions