Do all spicedb clients have full read+write access? Is there a way to make read-only clients and/or limit what definitions a client could write to?