IDS for defining a subset?

We are planning to use IDS in my company and thinking how we integrate it in our existing systems.
So what I do not really understand how I can control what is the user allowed. So for example some objects or propertys are only for coordination/read only. But there also clearly data which has to be allowed to be “edited”. How is this thought to realize, did I missed something?