[CalendarServer-users] Read only access to CardDAV

I've got myself a nice new CardDAV server setup and I'm working on the user accounts - just through the XML based directory. I would like to have one collection of contacts which has an admin user with read/write access but to also have a subordinate user who can connect to this collection with read only access. I don't particularly need to be able to provide a separate contacts collection for the subordinate user. The current thinking is to have a Principal which is listed in the caldavd.plist as a ReadPrincipal and then to symlink the folder for that principal into another location, which is listed as AdminPrincipals - Is this really the best way to do this? Thanks in advance Tom Harvey