Panels IPE permissions are not granular enough

Note: This issue expands on [#1539928]

Panels IPE is controlled by a few permissions:

1. Use the Panels In-Place Editor
2. Change layouts with the Panels In-Place Editor

The first one grants access to the entire IPE functionality, the second one controls access of a sub functionality: changing layout. It's perfectly possible to give access to IPE while disallowing layout changes.

Apart from that, there are lots of other CTools and panel related permissions such as the use of page manager, the panels dashboard, and so on. I don't think these are relevant to the discussion of controlling access to IPE because they don't affect IPE as such. A role can't have access to panels from the backend but still be able to use the IPE to change the content from the frontend theme. Merlin has already stated several times this is intended behavior: I agree.

The same goes for everything which plugs into the system via CTools: node access, custom panes, panelizer, etc. On the surface, node access and IPE access are 2 related things, but on a system level, they are two completely separate things.

However.

If you look at the implementation of IPE permissions themselves, they don't cover more intricate use cases where panels are used in more complicated contexts. Panels used within Organic Groups & Domain context are the first to come to mind, but basically anything could go (Heck, I should even be able to add time based access to IPE if I want to without hacking the entire thing).

(Disclosure: I'm currently blocked by IPE not playing nice with Domain: the same page is reused over different domains, but access to it's content via IPE should be restricted to only 1 domain)

The problem:

The IPE panels_renderer_pipeline (Exported definition in panels_ipe_pipelines.inc) uses the CTools perm plugin which basically doesn't do much then a user_access check against the 'use panels in place editing' permission.

Possible solutions

Since the IPE pipeline is a CTools plugin itself, I was wondering if there is some way to alter the plugin or the $pipeline object and switch the perm access plugin with a custom perm access plugin.

At this time, I can't find a hook where I could plugin in to do this. So, I'm considering creating my own pipeline renderer plugin implementing an adapted, custom access plugin while extending the panels_renderer_ipe class. (Is this even do-able at all?)

Easiest would be if we could alter the object in hook_default_panels_renderer_pipeline() and run ctools_export_crud_load_all('panels_renderer_pipeline') with the $reset flag I think.

Patching the IPE module would compromise the nice loose-coupling between the different systems, so I would't go there at all.

Any advice?