Is it possible to make a proxy tool that allows use of web services but restricted to a specific node in the Institutional Hierarchy? We have a college who is using a separate SIS system (for a subset of their courses, lots of short seminars, courses that last an entire calendar year, etc.) that wants programmatic access to create, enroll and remove courses -- but for security and just general tidiness I'd rather not let their tool be able to, for an extreme example, accidentally un-enroll all of the classes in our system.
Possible? I have gone over SIS integrations with them and for various reasons they would prefer to work via WS.