[eightysixfour]

I'm sorry, restricting user's ability to change their computer is not innovation. It is paternalism.

[bsharper]

The user can change anything they want, but a process launched by your user doesn't inherit every user access by default. You (the user) can give a process full disk access, or just access to your documents, or just access to your contacts, etc. It's maximizing user control, not minimizing it.

[eightysixfour]

I am talking about removing the ability to install kernel extensions.

As for full disk access, go try and remove Photo Booth from you Mac.

[wtallis]

The user isn't being restricted. Third-party software is being restricted, by default, and those restrictions can be disabled by the user.

[samcat116]

This is a feature not a bug in the enterprise.