“We need a read only role.”
It seems like such a simple requirement. Users have been requesting a read-only role for several years now. Why is it so tough to implement?  Because it calls for modifying access control policy across multiple, disjoint services deployed at innumerable distinct locations.
“We need help in modifying policy to implement our own read only role.”
This one is a little bit more attainable. We should be able to provide better tools to help people customize their policy. What should that look like?
We gathered some information at the last summit, and I am going to try and distill it to a requirements document here.