A Rundeck ACL policy file that allows users in a specific group to run jobs, view nodes, view activity logs, run adhoc jobs in a specific project.

rundeck-read-run-only.aclpolicy

---
description: "Allow users in runjobs group to run, kill jobs, etc. in the project called specific-project-name"
# They can also read the activity logs and view the nodes.
context:
  project: specific-project-name
by:
  group: runjobs
for:
  resource:
    - equals:
        kind: job
      allow: [read, run, kill]
    - equals:
        kind: node
      allow: [read]
    - equals:
        kind: event
      allow: [read] # allow reading activity logs
    - equals:
        kind: 'adhoc'
      allow: [read,run,kill]
  adhoc:
    - allow: [read,run,kill] # allow running/killing adhoc jobs
  job:
    - allow: [read,run,kill]
  node:
    - allow: [read,run] # allow read/run for nodes
---
context:
  application: rundeck
description: "Users in the 'runjobs' group can launch jobs in the project called specific-project-name but not edit them"
for:
  project:
    - match:
        name: 'specific-project-name'
      allow: [read]
  system:
    - match:
        name: '.*'
      allow: [read]
by:
  group:
    - runjobs