Permissions required to create and modify a query in Configuration Manager is:

Read
Create
Modify

However if you have configured folders in the Query object you might end up with this error.

The error message states that you don’t have permissions to create the query – but that’s not true. The query is created just not in the folder you [...]

Defining permissions requires configuring access rights in the Config Mgr. console and adding objects to predefined groups on the site server. In this example I am defining permissions to the service desk role.
Role description:

Access to a user defined administrator console.
Permissions to work with all objects in the “All workstations” collection.
Permissions to to use remote tools.
Permissions [...]