Users still need the capability to search but I do not want them to created anything, IE - dashboards, saved searches, alerts, etc, etc. Anywhere on the system. I am testing with Enterprise 10.2 and have removed a few edit_* capabilities but my test user can still create dashboards. I have a test role that is inheriting the default user role.
What is the harm? User's dashboards will only be visible by the user.
Because we want to control all content that is created. To also prevent wasting resources and impacting overall performance. Running searches for discovery is fine but anything more we want to prevent where possible.
That's what limits and workload policies are for.