This is proposal of permission assignment. It includes creation (or reusage) of 3 roles:

1. experiment_read_only - can only read objects (SELECT on tables)
2. experiment_read_write - all of the above plus modify existing objects (SELECT, INSERT, UPDATE, DELETE on tables), but cannot create new tables.
3. experiment_admin - all of the above plus create new objects in schema (create tables).

Example includes creating these roles, creating new schema, setting permissions for existing objects of schema, setting permissions for future objects of schema and creating users of all types.

After implementing this proposal all current and future users will have appropriate access to all current and future database objects, including rows, tables, routines etc.

CREATE ROLE experiment_read_write NOLOGIN;
CREATE ROLE experiment_read_only NOLOGIN;
CREATE ROLE experiment_admin NOLOGIN;

GRANT CONNECT ON DATABASE postgres TO experiment_admin, experiment_read_write, experiment_read_only;

CREATE SCHEMA myschema;

GRANT USAGE ON SCHEMA myschema TO experiment_read_write, experiment_read_only;
GRANT ALL PRIVILEGES ON SCHEMA myschema TO experiment_admin;

All next commands in this section require that current user can administer roles experiment_admin, experiment_read_write, experiment_read_only. To achieve it, use commands:

GRANT experiment_admin, experiment_read_write, experiment_read_only TO CURRENT_USER WITH ADMIN OPTION;

and

REVOKE experiment_admin, experiment_read_write, experiment_read_only FROM CURRENT_USER;

GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA myschema TO experiment_admin, experiment_read_write;
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA myschema TO experiment_admin, experiment_read_write;
GRANT ALL PRIVILEGES ON ALL ROUTINES IN SCHEMA myschema TO experiment_admin, experiment_read_write;
GRANT SELECT ON ALL TABLES IN SCHEMA myschema TO experiment_read_only;
GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA myschema TO experiment_read_only;

ALTER DEFAULT PRIVILEGES FOR ROLE experiment_read_only, experiment_read_write, experiment_admin IN SCHEMA myschema GRANT ALL PRIVILEGES ON TABLES TO experiment_read_write, experiment_admin;
ALTER DEFAULT PRIVILEGES FOR ROLE experiment_read_only, experiment_read_write, experiment_admin IN SCHEMA myschema GRANT SELECT ON TABLES TO experiment_read_only;
ALTER DEFAULT PRIVILEGES FOR ROLE experiment_read_only, experiment_read_write, experiment_admin IN SCHEMA myschema GRANT ALL PRIVILEGES ON SEQUENCES TO experiment_read_write, experiment_admin;
ALTER DEFAULT PRIVILEGES FOR ROLE experiment_read_only, experiment_read_write, experiment_admin IN SCHEMA myschema GRANT USAGE, SELECT ON SEQUENCES TO experiment_read_only;
ALTER DEFAULT PRIVILEGES FOR ROLE experiment_read_only, experiment_read_write, experiment_admin IN SCHEMA myschema GRANT ALL PRIVILEGES ON ROUTINES TO experiment_read_write, experiment_admin;

This user can only read existing objects. But in schema public it can also create and manage his own objects, like tables.

CREATE ROLE reader1 WITH LOGIN PASSWORD 'mypass1';
GRANT experiment_read_only TO reader1;
GRANT reader1 TO CURRENT_USER WITH ADMIN OPTION;

ALTER DEFAULT PRIVILEGES FOR ROLE reader1 IN SCHEMA myschema GRANT ALL PRIVILEGES ON TABLES TO experiment_read_write, experiment_admin;
ALTER DEFAULT PRIVILEGES FOR ROLE reader1 IN SCHEMA myschema GRANT SELECT ON TABLES TO experiment_read_only;
ALTER DEFAULT PRIVILEGES FOR ROLE reader1 IN SCHEMA myschema GRANT ALL PRIVILEGES ON SEQUENCES TO experiment_read_write, experiment_admin;
ALTER DEFAULT PRIVILEGES FOR ROLE reader1 IN SCHEMA myschema GRANT USAGE, SELECT ON SEQUENCES TO experiment_read_only;
ALTER DEFAULT PRIVILEGES FOR ROLE reader1 IN SCHEMA myschema GRANT ALL PRIVILEGES ON ROUTINES TO experiment_read_write, experiment_admin;

REVOKE reader1 FROM CURRENT_USER;

This user cannot create new objects in schema, like tables. It can read, write, delete and update existing objects (for example, modify rows in tables).

CREATE ROLE writer1 WITH LOGIN PASSWORD 'mypass2';
GRANT experiment_read_write TO writer1;
GRANT writer1 TO CURRENT_USER WITH ADMIN OPTION;

ALTER DEFAULT PRIVILEGES FOR ROLE writer1 IN SCHEMA myschema GRANT ALL PRIVILEGES ON TABLES TO experiment_read_write, experiment_admin;
ALTER DEFAULT PRIVILEGES FOR ROLE writer1 IN SCHEMA myschema GRANT SELECT ON TABLES TO experiment_read_only;
ALTER DEFAULT PRIVILEGES FOR ROLE writer1 IN SCHEMA myschema GRANT ALL PRIVILEGES ON SEQUENCES TO experiment_read_write, experiment_admin;
ALTER DEFAULT PRIVILEGES FOR ROLE writer1 IN SCHEMA myschema GRANT USAGE, SELECT ON SEQUENCES TO experiment_read_only;
ALTER DEFAULT PRIVILEGES FOR ROLE writer1 IN SCHEMA myschema GRANT ALL PRIVILEGES ON ROUTINES TO experiment_read_write, experiment_admin;

REVOKE writer1 FROM CURRENT_USER;

This user can create new objects in schema

CREATE ROLE admin1 WITH LOGIN PASSWORD 'mypass3';
GRANT experiment_admin TO admin1;
GRANT admin1 TO CURRENT_USER WITH ADMIN OPTION;

ALTER DEFAULT PRIVILEGES FOR ROLE admin1 IN SCHEMA myschema GRANT ALL PRIVILEGES ON TABLES TO experiment_read_write, experiment_admin;
ALTER DEFAULT PRIVILEGES FOR ROLE admin1 IN SCHEMA myschema GRANT SELECT ON TABLES TO experiment_read_only;
ALTER DEFAULT PRIVILEGES FOR ROLE admin1 IN SCHEMA myschema GRANT ALL PRIVILEGES ON SEQUENCES TO experiment_read_write, experiment_admin;
ALTER DEFAULT PRIVILEGES FOR ROLE admin1 IN SCHEMA myschema GRANT USAGE, SELECT ON SEQUENCES TO experiment_read_only;
ALTER DEFAULT PRIVILEGES FOR ROLE admin1 IN SCHEMA myschema GRANT ALL PRIVILEGES ON ROUTINES TO experiment_read_write, experiment_admin;

REVOKE admin1 FROM CURRENT_USER;