could also write a client script that on pageInit checks roles that should access and then redirects based on that

The problem is isolating the button from the sublist, if I catch what your suggesting to be using a form with button and a form without. The form doesn't seem to have the flexibility I want.