Form API already provides a backend for this. I guess we will follow the node level access route and leave this to contrib.