limiting user execution rights