I think one way to do it is to make the TCL API visible in PHP e.g. by having a command "nsd_tcl(tcl-command, return-variable)" work there. To do this, you'd have to write something up in C I assume and put it to use in your aolserver installation.
Once this is done (ask Bjoern Kiesbye or at the AOLserver list if this really is feasible and if someone has done it / would be willing to do it), you can add a check to the PHP packes, calling acs's permission::require_permission.
If you want to go down that road, let's talk further, as I think having the capabilities for calling ACS functions from PHP (and vice versa), will help a lot in the rollout of bundled solutions (as some PHP software is considerably better than OpenACS in certain, specific areas). Last but not least it makes it easier to market.
