It should be possible to query the rest API if certain actions like adding a user to a group are allowed for the user to perform. See the support case for more information.
Hints:
Either we can add a method to test, if a IdentityService is read only or we could provide this feature via availableOperations (see here), which would only return the read only operations.
This ticket was migrated to github: https://github.com/camunda/camunda-bpm-platform/issues/2228. Please use this link for any future references and continue any discussion there.