Do not allow users to post content to organic groups except from within an organic group

Note that removing any content type you add this to from the "Create content" menu (Organic groups provides its own create content menu) is highly advised.

Furthermore we're going to restrict people (non-admins) to one and only one group at a time.

This approach allows Agaric to hack in whatever exceptions we want later (planned: allow posts for discussion spaces to post to post to multiple discussion spaces), without hacking organic groups (skip down to the resolution to see Agaric's solution).

So... giving an access denied in this form_alter at least (this function is called for the message node form) causes one access denied page and immediately below it an entire redo of the whole page layout, site structure with header and all with the same form we're trying to get rid of, albeit with an "Access Denied" as the title instead of the normal submit form text.

function wsf_action_fa_require_group_passin() {
  if (!user_access('administer nodes')) {
    if ($_SERVER["REQUEST_METHOD"] == 'GET') {
      $gids = $_GET['gids'];
    }
    elseif ($_POST['og_groups_hidden']) {
      $gids = unserialize($_POST['og_groups_hidden']);
    }
    if (is_array($gids) && count($gids) == 1) {
      return;
    }
    drupal_access_denied();
  }
}

Not failsafe: http://api.drupal.org/api/function/drupal_access_denied/5

Well, there's always more than one approach.

Resolution

do not let people post to multiple groups... for real this time

This worked!

function wsf_action_form_alter($form_id, &$form) {
  switch ($form_id) {
    case 'message_node_form':
      wsf_action_fa_require_group($form);
      break;
  }
}

function wsf_action_fa_require_group(&$form) {
  if (!user_access('administer nodes')) {
    if ($_SERVER["REQUEST_METHOD"] == 'GET') {
      $gids = $_GET['gids'];
    }
    elseif ($_POST['og_groups_hidden']) {
      $gids = unserialize($_POST['og_groups_hidden']);
    }
    if (is_array($gids) && count($gids) == 1) {
      return;
    }
    drupal_set_message(t('You may only post @types from within an action or discussion space.', array('@type' => $form['type']['#value'])));
    $form = array();
  }
}