We created an API user with read only access to all zabbix resources. It works great.

After time, in our production system, administrators started to adding some host groups to zabbix. By default, new host groups and hosts were DENY to our API user because it was 'User type': 'Zabbix User'. Administrators always forget to add newly created host groups to the API user (as read only).

A great solution to this would be new 'User type' - 'Read only Zabbix User'. By default it would have read only access to every zabbix resource.