Thanks for your questions.
1a + 2a. This is done using the grant API command. You can use the listpermissions command with verbose=true to see permissions changes which are pending sufficient consensus.
1b. This can be done at any time.
3. It's a future possibility for asset creation, but unlikely to be done for regular transactions with this sort of mechanism. You might want to consider using multisignature outputs instead.
4. Not yet!