Open Stack

Hi, all.  Beginning to roll out a newer-than-what-we-had OpenStack 
release -- likely to be Pike, "For reasons."  (Which is still *worlds* 
newer than Juno, where we are.)  And I've been asked if there's such a 
thing as an account (or ACL) that allows a user to read everything, but 
write nothing.  Googling, I see mention of such things -- but nothing 
really firm.  Does it exist?  Is it in Pike (or more recent releases)?  
If it doesn't exist, is there a graceful way to make it happen, anyway?

Thanks!

-Ken