Read one KSDS record by key without opening writes

We need a single KSDS read by key for a partner. We do not want insert or update available on the same API. How is that split?

Read-by-key is a separate call. It needs the dataset name and the key, and it uses RACF basic credentials. It is not on the write surface. A missing key is a not-found. A RACF failure is forbidden. Insert, update, and delete stay closed until the write surface is opened on purpose. You can offer the read without offering the write.