Add an intermediate MQ Console / REST role between MQWebAdmin and MQWebAdminRO

The MQ Console and administrative REST API offer only two authorisation levels: MQWebAdmin, which grants full administration of every connected queue manager, and MQWebAdminRO, which is read-only. There is nothing in between.

Application teams need a small set of operations on their own queues in non-production — browse messages while debugging, drain a queue after a bad deployment, check channel status. None are possible under MQWebAdminRO, and MQWebAdmin is far too much: under REST API v3 it permits arbitrary MQSC against every connected queue manager, because the typed per-object resources are superseded by a single generic endpoint, POST /admin/action/qmgr/{qmgrName}/mqsc, that accepts any command in the request body.

So the practical choice today is to over-grant full administration, or to deny self-service and absorb routine requests as platform-team work.

WHAT WE ARE ASKING FOR

A third role granting the messaging REST API plus read-only administrative access, while denying the administrative mqsc resource. The messaging API is already a separate endpoint family, so this needs no new authorisation machinery.

ENDPOINTS IT SHOULD REACH

GET /ibmmq/rest/v*/messaging/qmgr/{qmgrName}/queue/{queueName}/message — browse

DELETE /ibmmq/rest/v*/messaging/qmgr/{qmgrName}/queue/{queueName}/message — destructive get, drain

POST /ibmmq/rest/v*/messaging/qmgr/{qmgrName}/queue/{queueName}/message — put a test message

The CLEAR QLOCAL, DISPLAY QLOCAL and DISPLAY CHSTATUS verbs, currently reachable only through the generic mqsc endpoint

ENDPOINTS IT MUST NOT REACH

DEFINE and DELETE of any object, ALTER QMGR, START and STOP CHANNEL, SET AUTHREC, SET CHLAUTH, REFRESH SECURITY — all of which route through that same single mqsc endpoint.

We are also filing a companion idea for per-queue-manager role scoping. The two compound: an intermediate role still applies application-wide, so without scoping it would grant these operations on every connected queue manager.