There seems to be no easy way to do this, because functions run from the menu is always executed as "user at the keyboard".
One workaround is to publish a Web App to always "Execute as" Owner. This web app will then write to protected ranges on doPost()
. The function linked to Menu UI will then use UrlFetch
to POST to the published Web App. You can also use some basic authentication with a password/randomly generated numbers to reject requests from outside your script.
Also, If you don't trust editors not to mess with your bound script, It's better to publish it as a private add-on, where the source code is not easily accessible.