Access management - "read-protection"

The same way as we have write protection on a dataset, I think it would be useful to be able to have read-protection, ie only read access on some resources on specific datasets for specific groups

At the moment, if I want to restrict access to a specific dataset, I need to add all the others into the groups I want to scope access to. 

Similarly, we can give access to specific resources, but we cannot NOT give access to others, unless we want specifically add all the others into the access management. 
If we had at least this capability through datasets, it would help

And being able to scope access on a root asset would also be helpful