cookie as auth with subdomains

Situation:

• Let's say I have top domain myopensite.org
• I let people make subdomains whatever.myopensite.org, joe.myopensite.org
• Users have full power in what they do in their subdomains. Basically using DNS i point user to their server. As admin I run myopensite.org, joe is running joe.myopensite.org
• Using session ID, users are logged in to my myopensite.org website

Problem:

• I want developers under all subdomains *.myopensite.org to know who is logged in in myopensite.org (if logged in)
• But the problem is if they'll get user auth/session cookie they will be able to like as him in top domain/other subdomains.

---

Is there a way/workaround to do this or this is a problem with impossible solution?

Other way: cookies around .topdomain.com are shared but I don't want subdomain.topdomain.com developers to log in into .topdomain.com using other users cookie/session id