As a sysadmin, I want the ability to create restricted accounts which have the ability to access projects and collections which have been shared with them, but which do not have the ability to submit compute jobs or to upload new data.

Since it's likely that we'll want to control read/write and compute separately in the future, the implementation should provide separate permissions for each.