You cannot set the permission to read a certain attribute on the one hand and the starting to create a certain object class on the other type in the sam access control entry. The reason for this is that only one scope specifier is allowed per ACE. For such entries, several different ACEs are necessary..
In this post, I will give you a sample demonstration of how you could use Descriptor types to datong information about Properties, Attributes, Events, etc. I hope you could use the code later while building your library. TypeDescriptor is a static sealed class which makes the starting point of the API. It exposes information of the object in terms of Properties, Attributes, Events, etc. Even though the basic usage of TypeDescriptor is to get metadata of an object, yet it also exposes features to extend the object on the fly.