How to Override OG Group Owner Permissions for view/edit group content? So I have a group content type called student portfolio, which is managed by the student. Then I have a group content node type called endorsement that can be written by professors that are group members. 

Question 1: How do I prevent students from editing endorsements? There is no checkbox anywhere in my configuration that says the student role can edit endorsement. Also, on my group permissions, for Members, only "Edit own Endorsement content" is checked, but the student can still edit, which seems like a bug if you ask me.

I'm thinking I'll need some sort of hook_menu_local_tasks_alter() code, but just wanted to verify.

Question 2: How do I prevent the student from even viewing a group content page type? (This is a different project.) On the group page, I think this is just a simple matter of setting the permission on the pane, but I also don't want students to be able to view the stand-alone page.
Because group owners are considered the equivalent of "Super administrator" (user 1) of their group AND group content, which I happen to totally disagree with, this wound up being solved using hook_node_access() as follows for Question 1:

/**
 * Implements hook_node_access().
 *
 * Runs every time a user tries to edit an endorsement
 */
function icme_admin_node_access($node, $op, $account) {
  if ($node-&gt;type == 'endoresment' &amp;&amp; $op == 'update') {

    // Does the user explicitly have create/edit endorsement content access?
    // By default, the OG module provides group owners add/edit/delete access
    // to all group content
    $ua_create = user_access('create endoresment content');
    $ua_edit = user_access('edit own endoresment content');    
    if (!$ua_create &amp;&amp; !$ua_edit) {
      // Show access denied message, and, interestingly enough, 
      // also sets the permission for the edit link.
      return NODE_ACCESS_DENY;
    }
  }
}


Question 2 is similar, but just need to change $op == 'update' to $op == 'view'.

I'm curious to see if anyone posts a better solution (other than fixing the OG module).