Hopefully all admins does that. Never allow a user to run any command if you intend for them to run just one. SSH public keys have the exact same feature howev

Hopefully all admins does that. Never allow a user to run any command if you intend for them to run just one. SSH public keys have the exact same feature however. Look at "command=" under "Authorized Keys File Format" in the man page. This is a good idea for batch jobs that uses SSH to execute on remote machines. With SSH keys you even have the option of limiting keys not just to certain commands but to certain IP addresses. By limiting the SSH keys you also don't have to give your keys access to an unprivileged shell where you don't need it.