I'm working on a multi-vendor marketplace using the power of drupal commerce.
Now I'm stuck in order permissions.

Vendors can insert their own products and manage pricing, shipping and stock independently. Payment will be direct Customer->Vendor, so I don't have to care too much.
Check-out has been semplified so now each cart can have one single product, to create an eBay-like experience.

At checkout an order is owned by the customer, but (by rules) I'm putting the Product's creator user into an Entity Reference field ("field_vendor"), in the order.

I have to let the vendor to view and edit that orders.
It would be great to have something like Node access user reference working for entities, but as far as I found, entity_access has no hooks (just an old patch), so this generic way looks difficult.

Now I'm working on my own module to give access to referenced users just for commerce_orders.

Can I hook commerce_entity_access and commerce_entity_access_query_alter?