Update if anybody got to this thread. A possible answer to this may be
utilising TACACS+ to authorise commands. It might be a killer depending
on your use case, but still.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-TAC...