Fine grained security is on our roadmap - though we are finalizing some internal planning before we can post the schedule.  We'll be posting more about these new features shortly in preparation for our set of fall releases.

You are correct, I'll try to clarify though,

The objective for read only within the application is to allow a user to be assigned edit rights to one project, but read only on another.  In that case, the user would need to be assigned to a named or floating license.

If a user is assigned to a read only license or you've exceed the number of log-in's, a user's permissions are overridden by the system and they are "read only" which takes precedence over individually assigned rights to projects.

We wanted to separate the two functions so users can be added and setup in the system initially as read only, but if a license is purchased or allocated to them at a later time, their permissions within Contour are setup correctly.

Hope this helps.