Jordan,
I'm not sure if I have understood you correctly, but if you define the connections to your other servers and databases in SAS Metadata and use something like the metadata libname engine for your external connections, you should be able to use metadata security to allow or deny individual users access to the connections, and provide individual passwords for authentication domains which should be picked up automatically serverside by metadata. This would be managed by the PLM I think.
For me the best feature of the sas stored process web app is that each stored process execution automatically inherits the authenticated metadata context of the user the STP executed as. Have you tried this approach? Or are you saying that that's exactly what you'd like to avoid doing?
Nik