Encrypted read-only message queue
If you aren't worried about collusion or dynamic group membership, then a very simple solution is to simply have one key for encrypting the messages and another for signing them.  The encryption key gives someone read access and the signing key gives them write access.  Only nodes with the encryption key will be able to successfully decrypt the messages and read them, and only nodes with the signing key will be able to produce "valid" messages that have correct signatures.  The encryption key would be a symmetric key and the signing key would be a private key.  Everyone would have access to the public key to verify that messages were constructed by an authorized node.

If you need more complicated logic or a more flexible system, you can use cryptographic role-based access control, which usually makes use of attribute-based encryption.  But that solution will be very, very complicated.