Also... how do we control who can run meta commands?
You cannot do so directly but you can control permissions to the underlying schema that the meta-command queries touch so that attempting to run the meta-command fails.
This is not as simple as it may seem; visibility of the schema is considerably more permissive than visibility of data.