luci-config: fine-grained acls

appengine/config_service/proto/project_config.proto

Index: appengine/config_service/proto/project_config.proto
diff --git a/appengine/config_service/proto/project_config.proto b/appengine/config_service/proto/project_config.proto
index 0d4f2ebfd5869b4d311542f2eae1dea10b5f164e..48391160eabbae7ec8640c68577150ade0b4fbfd 100644
--- a/appengine/config_service/proto/project_config.proto
+++ b/appengine/config_service/proto/project_config.proto
@@ -12,6 +12,15 @@ package config_service;
 message ProjectCfg {
   // Full name of the project.
   optional string name = 1;
+  // A list of identities that have read-only access to the. An element is one
+  // of:
+  // * "group:<group>", where group is defined on auth server.
+  // * "<email>"
+  // * "<identity>"
+  //
+  // If not specified, only admins and trusted services have access.
+  // Talk to admins to determine the group name appropriate for your project.
+  repeated string access = 2;
 }
 
 // Schema of refs.cfg.