[fadetree]

It may be hard to give someone the ability to 'do ip exceptions' without giving them ability to do a lot of other stuff. You are assuming that control is fine grained enough to protect areas; in my experience things usually boil down to editing source or config files or tables directly.