pulumi RBAC - I just set it up so base access is READ by default and only our CI/CD account has WRITE