I’d do red/write and enable nfo files alongside the media files.
Then I’d use an admin account for admin stuff and a regular user without any edit permissions.