http://arstechnica.com/news.ars/post/20060113-5975.html From all the reading I have done it seems that configuration would be much easier for most system admins. A utility can learn what access is needed by monitoring the app so that you don't have to know all the details of what the app touches to get it working for new apps.