We managed to kludge our way to defaulting to read only, then using set role to do writes if you need to.