You can also restrict commands through sudo. I have a number of
developers that need sudo access so I have a list of commands that they
are not allowed to run like any jamf commands. here is the sample code
to add to suders ALL=(ALL) ALL ALL =
!/usr/...
