Its funny because I have been asked by some folks at work as to why I dont just 'allow all commands' and instead review each one, and then I let my colleague in infosec know who asks that so they are aware of dangerous users.
It's more ergonomic to put them in a fully isolated virtual machine and let them cook.