[WIP] readonly

Allow defining `readonly` config.

Still needs clarification on whether this disallows all types of writing/modifications/deletions, or just nukeable ones.