There are some issues on the dynamic & confidential support, please refer to the mail list thread: https://fedorahosted.org/pipermail/rhq-users/2011-February/000319.html
The read only & confidential depends on the deployed resource instances, but these attributes are pre-defined as meta data in the rhq-plugin.xml, which will be persisted when the plugin is installed.
We can not change the read only state after the plugin insatlled.