CloudKit server to server security role

Is it possible to assign a server to server key to a security role? I want to have authenticated users read from certain record types but not be able to write or create, thats for the server to do. How can this be done? Are S2S keys always treated as a plain old authenticated user without special roles?