The use case is that every user should see their cases and their activities, but only certain users (based on their Drupal roles and permissions) should be able to change the status of some activities. The build up of the activities in the case summary form/page is not done in advance and does not show up in the buildForm hook. It is a jQuery datatable with a source url that is linked to CRM_Case_BAO_Case::getCaseActivity. What I have done is create a page in my extension and replace the sourceURL in the datatable with one in my extension, and in the callback replace the core method CRM_Case_BAO_Case::getCaseActivity with my own specific one. Any suggestion for another / better method?
Perhaps enhance core to provide a 'CiviCRM: edit activities' permission. I don't think it would be that difficult. We're currently adding permissions based on financial types of objects in contributions (like line items, premiums, etc) and it isn't that bad. With an edit permission you don't have to worry about reports, etc.