ictime works with relatively detailed permissions that can be asigned based on JIRA groups (see ictime Permissions). So you can flexibly create the user roles you need. As a special feature, we offer a workaround to cover some permissions regarding viewing time tracking data that in fact are missing in JIRA (see JIRA Permissions).
Please keep in mind that additional JIRA permisions are required to use time tracking or might be useful to correctly configure users ("work on issues" permission is required; edit & delete work log permissions might be useful; http://confluence.atlassian.com/display/JIRA/Managing+Project+Permissions) and time tracking needs to be activated (see http://confluence.atlassian.com/display/JIRA/Configuring+Time+Tracking).