Read Only Keychain Elements There is a way to add applications to a "always allow access"-list for a specific keychain entry. Those applications get read/write permissions to that entry. Is it possible to make keychain only grant readonly access to certain applications?
The short answer is no.

This question straddles the line between a general discussion how the API works and how a user can use the tools as written.

The Keychain API only allows access - it's up to the programmer / developer to determine if a read or a write will happen and end users can't realistically change that behavior.

Using the built in Keychain tools and the Keychain app supplied by apple, you can't define a group of apps. You can't even select four or ten apps at once and add them in one step for a specific keychain entry. (The picker for adding apps simply won't allow you to select multiple apps or a folder containing those apps or aliases to those apps you wish to add together.)

The only workarounds would be to write a utility that knows how to handle a group of apps or a folder of apps and iterates over each and calls the keychain API to do the work. There is a basic dictionary or keychain in AppleScript, but it doesn't have any ACL specific commands, so you'll have to dig in the developer documents to see if it's even possible to automate with that tool.