Your approach fails in two respects:
1. The machines with rw access may be multiuser machines with a security model you want to respect. Thus, you can't assume everyone with access to that machine can/should have root rw access. 2. The machines with ro access can still read all files.
Bruce