Granular access controls are nice under certain scenarios, but adding a basic ACL isn't hard. "Can use Splunk" and "Can't use Splunk" is enough control for me at the moment, fortunately.