It should be possible to query the rest API if certain actions like adding a user to a group are allowed for the user to perform. See the support case for more information.
Hints:
Either we can add a method to test, if a IdentityService is read only or we could provide this feature via availableOperations (see here), which would only return the read only operations.