Change the nature of SOS completely and only allow access from the portal using an Openstack style console. Users should be able to click "console" in the GUI to get a popup SOL console protected inside the portal. That would allow RBAC and other controls to trickle down to this feature. This is becoming a common request from the enterprise space.