I think one approach would be getting the user input in player controller or anything the player owns, “with the actor parameter” requesting something like:
"I(client) want you(server) to execute this function on this actor",
then, you can get that on the server side player controller (or wherever it was), and behave accordingly, checking user access…etc…
instead of calling on an actor something like:
CastSpell(spell)
you call on player controller:
CastSpellFromActor(actor, spell)
if it is “your” spell, then just pass ‘this/self’ as the actor.
This way actually you can implement GM functionality easily. - Because, they should be basically do most of the things on a specific actor.