Constant READ_ONLY_ROLE 

pub const READ_ONLY_ROLE: &str = "manta-read-only";

Realm role string that puts the server into read-only mode for this caller. A token carrying this role is refused (403 Forbidden) on every mutating endpoint under /api/v1/* by the server’s auth_middleware::read_only_guard.