There is some potential there, thanks for the suggestion. In our usage case we have groups of people that need to see all nodes, but only unmanage/remanage particular subset(s). I was thinking along the lines of using two groups to give access, one group to have "read-only" access and a second to give node management rights, but then on it use account limitations to only see the nodes particular to that group. However these permissions don't cascade in the web interface (it would seem deny always trumps allow), so I would assume they similarly do not when using SWIS.
While the SDK would seem to address some of the issue, it would still seem that I would need to wrap it with a completely custom authorization layer separate from anything that is maintained via Orion, and that is something I really want to avoid.