Hi!
I found this story (https://www.pivotaltracker.com/n/projects/1250084/stories/116678871) and would make a suggestion hot to solve this may in a nice, admin-focused, family save way.
My idea is to a add two new functions, controlled on the frontend like this:
cards: ...
show_header_toggle: ...
show_on_state: [alarm_panel_states]
show_on_user: [usernames]
show_on_state default is “all” and cold be the state of the alarm panel arm_home, arm_away, arm_night and shows the panel or card only on this states.
show_on_user default is “all” and could be any user and will show the card or panel on the given user.
For home use this should be enough but I’m not sure about open this to the internet. And hacker-friends could may also control some things more I think 
But if I go forward, with this permissions on scripts, service calls and scenes, It would be more difficult to get access.
What do you think?