While Safeguard ACLs provide protection at the file/process level, it can be desirable to have even tighter control of user activities down to the individual command, subsystem or application a user might or might not use.