I've worked around it.

I currently have a perl script that does moth of my automation buy watching drop directories and "doing stuff" as needed.

It allows setting of the user to run as and executes the program via:
su -c "Command to run" User_To_Run_As

This allows full group(s) access.

I was hoping to avoid the setup portion (10 lines or so of a config file) but I bit the bullet.