Sounds like the solution is to set the audience for the restlet to a restricted set of roles, and use the restlet to kick off the scheduled script.