Currently there is no way to specify, using the json results, which actions to show and which not to show, especially for (but not limited to) custom actions.
In the current implementation, it is required to have edit rights for an item in order to see any action or to be an admin:
An improvement to this is to use the row.doc_has<action> as a convention and allow each action to specify if it should be displayed or not:
Note: This also allows overriding an admin's action visibility. This makes sense when dealing with custom actions. If no 'override' is specified, the action is displayed by default, as it does now.