As a last resort, that is what I will do. But that would mean to fight the system, which is rarely a good thing in the long run. When it comes to system setup, I prefer to color inside the lines if at all possible.

"Configuring which programs a restricted user can run" is _such_ an elementary task for an OS that I cannot believe that recent macOS has no provisions for that. I _must_ be missing something.