Entitlements are great, right up until someone has to start manually deciding what access to give. After being blocked or questioned by the OS a handful of times, people are going to either disable the security or effectively disable it with wildcard matches.