Group owners should be able to grant and revoke job modification permissions for group members. This is part of http://beaker-project.org/dev/proposals/enhanced-user-groups.html
Specifically, here's what I'm thinking: 1. The "job modification" privilege goes away. All group members can modify jobs submitted on behalf of that group. 2. Each user account gains the ability to specify other accounts that can submit jobs on their behalf 3. When submitting a job, you can nominate a different user that will appear as the job submitter. All other permissions (including future modifications to the job, and whether or not you can submit the job on behalf of a group) will be based on that user, rather than the automated account.
Sorry, the above quote was from ncoghlan.