You could allocate only "software update" capability to one group, "execution" to another, and have a permission system for deciding who can do what.

But what if the execution program took on a conscience of its own and decided to appropriate software update permissions for itself?