You can no longer place unless you are in admin or sandbox.

Content.Client/Sandbox/ISandboxManager.cs

@@ -1,7 +1,11 @@
+using System;
+
 namespace Content.Client.Sandbox
 {
     public interface ISandboxManager
     {
         void Initialize();
+        bool SandboxAllowed { get; }
+        event Action<bool> AllowedChanged;
     }
 }

Content.Client/Sandbox/SandboxManager.cs

@@ -1,4 +1,5 @@
-using Content.Client.UserInterface;
+using System;
+using Content.Client.UserInterface;
 using Content.Shared.Input;
 using Content.Shared.Sandbox;
 using Robust.Client.Interfaces.Input;
@@ -28,7 +29,10 @@ namespace Content.Client.Sandbox
         [Dependency] private readonly IInputManager _inputManager;
 #pragma warning restore 649
 
-        private bool _sandboxAllowed;
+        public bool SandboxAllowed { get; private set; }
+
+        public event Action<bool> AllowedChanged;
+
         private SandboxWindow _window;
         private EntitySpawnWindow _spawnWindow;
         private TileSpawnWindow _tilesSpawnWindow;
@@ -63,7 +67,7 @@ namespace Content.Client.Sandbox
 
         private void UpdateSandboxWindowVisibility()
         {
-            if (_sandboxWindowToggled && _sandboxAllowed)
+            if (_sandboxWindowToggled && SandboxAllowed)
                 OpenWindow();
             else
                 _window?.Close();
@@ -71,12 +75,12 @@ namespace Content.Client.Sandbox
 
         private void SetAllowed(bool newAllowed)
         {
-            if (newAllowed == _sandboxAllowed)
+            if (newAllowed == SandboxAllowed)
             {
                 return;
             }
 
-            _sandboxAllowed = newAllowed;
+            SandboxAllowed = newAllowed;
             _gameHud.SandboxButtonVisible = newAllowed;
 
             if (!newAllowed)
@@ -84,6 +88,8 @@ namespace Content.Client.Sandbox
                 // Sandbox permission revoked, close window.
                 _window?.Close();
             }
+
+            AllowedChanged?.Invoke(newAllowed);
         }
 
         private void OpenWindow()

Content.Client/UserInterface/EscapeMenu.cs

@@ -1,10 +1,12 @@
-using Robust.Client.Console;
+using Content.Client.Sandbox;
+using Robust.Client.Console;
 using Robust.Client.Interfaces.Placement;
 using Robust.Client.Interfaces.ResourceManagement;
 using Robust.Client.UserInterface.Controls;
 using Robust.Client.UserInterface.CustomControls;
 using Robust.Shared.Interfaces.Configuration;
 using Robust.Shared.Interfaces.Map;
+using Robust.Shared.IoC;
 using Robust.Shared.Localization;
 using Robust.Shared.Prototypes;
 
@@ -19,6 +21,8 @@ namespace Content.Client.UserInterface
         private readonly IResourceCache _resourceCache;
         private readonly IConfigurationManager _configSystem;
         private readonly ILocalizationManager _localizationManager;
+        [Dependency] private readonly ISandboxManager _sandboxManager;
+        [Dependency] private readonly IClientConGroupController _conGroupController;
 
         private BaseButton QuitButton;
         private BaseButton OptionsButton;
@@ -41,7 +45,14 @@ namespace Content.Client.UserInterface
             _prototypeManager = prototypeManager;
             _resourceCache = resourceCache;
 
+            IoCManager.InjectDependencies(this);
+
+            _sandboxManager.AllowedChanged += AllowedChanged;
+            _conGroupController.ConGroupUpdated += UpdateSpawnButtonStates;
+
             PerformLayout();
+
+            UpdateSpawnButtonStates();
         }
 
         private void PerformLayout()
@@ -88,7 +99,8 @@ namespace Content.Client.UserInterface
 
         private void OnSpawnEntitiesButtonClicked(BaseButton.ButtonEventArgs args)
         {
-            var window = new EntitySpawnWindow(_placementManager, _prototypeManager, _resourceCache, _localizationManager);
+            var window = new EntitySpawnWindow(_placementManager, _prototypeManager, _resourceCache,
+                _localizationManager);
             window.OpenToLeft();
         }
 
@@ -98,6 +110,20 @@ namespace Content.Client.UserInterface
             window.OpenToLeft();
         }
 
+        private void UpdateSpawnButtonStates()
+        {
+            if (_conGroupController.CanAdminPlace() || _sandboxManager.SandboxAllowed)
+            {
+                SpawnEntitiesButton.Disabled = false;
+                SpawnTilesButton.Disabled = false;
+            }
+            else
+            {
+                SpawnEntitiesButton.Disabled = true;
+                SpawnTilesButton.Disabled = true;
+            }
+        }
+
         protected override void Dispose(bool disposing)
         {
             base.Dispose(disposing);
@@ -106,5 +132,15 @@ namespace Content.Client.UserInterface
                 optionsMenu.Dispose();
             }
         }
+
+        public override void Close()
+        {
+            base.Close();
+
+            _sandboxManager.AllowedChanged -= AllowedChanged;
+            _conGroupController.ConGroupUpdated -= UpdateSpawnButtonStates;
+        }
+
+        private void AllowedChanged(bool newAllowed) => UpdateSpawnButtonStates();
     }
 }

Content.Server/Sandbox/SandboxManager.cs

@@ -1,6 +1,8 @@
 using Content.Server.GameTicking;
 using Content.Server.Interfaces.GameTicking;
 using Content.Shared.Sandbox;
+using Robust.Server.Console;
+using Robust.Server.Interfaces.Placement;
 using Robust.Server.Interfaces.Player;
 using Robust.Server.Player;
 using Robust.Shared.Enums;
@@ -15,6 +17,8 @@ namespace Content.Server.Sandbox
         [Dependency] private readonly IPlayerManager _playerManager;
         [Dependency] private readonly IServerNetManager _netManager;
         [Dependency] private readonly IGameTicker _gameTicker;
+        [Dependency] private readonly IPlacementManager _placementManager;
+        [Dependency] private readonly IConGroupController _conGroupController;
 #pragma warning restore 649
 
         private bool _isSandboxEnabled;
@@ -36,6 +40,24 @@ namespace Content.Server.Sandbox
 
             _playerManager.PlayerStatusChanged += OnPlayerStatusChanged;
             _gameTicker.OnRunLevelChanged += GameTickerOnOnRunLevelChanged;
+
+            _placementManager.AllowPlacementFunc = placement =>
+            {
+                if (IsSandboxEnabled)
+                {
+                    return true;
+                }
+
+                var channel = placement.MsgChannel;
+                var player = _playerManager.GetSessionByChannel(channel);
+
+                if (_conGroupController.CanAdminPlace(player))
+                {
+                    return true;
+                }
+
+                return false;
+            };
         }
 
         private void GameTickerOnOnRunLevelChanged(GameRunLevelChangedEventArgs obj)

Resources/Groups/groups.yml

@@ -53,3 +53,4 @@
   - rejuvenate
   - addcomp
   CanViewVar: true
+  CanAdminPlace: true