Add ability to declare which CRUD actions are allowed

[tfe]

I could use a way to declare that some models cannot e.g. be destroyed, only show/edit/updated.