An extension point is needed to run portal provided code within the portlet's servlet-context.
The concept is another pluto specific servlet in the web.xml that listens to a URL like: /pluto/admin/*
The string after hard path would correspond to a key in a adminServices Map injected into the portlet container.
The values of the Map would be some sort of PortletAdminService interface implementations provided by the portal.
The portlet container would provide an API so the portal could call container.runAdminService("foo", request, response) and the PortalAdminService interface impl keyed by the string "foo" would be executed via a cross context dispatch.
The PortletAdminService would have a method that had access to an AdministrativePortletRequest and AdministrativePortletResponse.