It's a hacky solution, but someone built a permissions system that shims in front of the API to restrict access for different users

https://www.reddit.com/r/homeassistant/comments/1vxw5pu/acce...