Iroha2 trying to follow permission ideology for ISI execution and queries.
Execution of every ISI passes through consensus and it ensures expected permissions execution while consensus is not broked.
Queries do not pass through consensus. It makes it possible to change Iroha2 codebase on one node and makes it possible to execute queries with unexpected rights for other network nodes. Other network nodes will just not know about such executions.