Let non-admin users run specific SYSTEM-level tasks with hash verification, audit logging, and none of the usual security nightmares.