What the GP is talking about is not letting developers install stuff on their PC. I assume this is also "run unknown exe" because.. well I can't see any reason

What the GP is talking about is not letting developers install stuff on their PC. I assume this is also "run unknown exe" because.. well I can't see any reason local root could hurt the network in a way my user account couldn't. Unless maybe the PC is shared, there's no difference of install (local root) compared to run as normal non-user, as far as attack surface on the network. So this comes back to: do you block "potentially malicious" executables or not? How do you tell if a new never-before-seen executable needs to be blocked, without either just blocking every unknown executable ("dev can't get anything done") or opening a giant loophole ("anything in x directory is safe")? Let me write it a different way: An exe with an unrecognized name and unrecognized sha256 suddenly appears on my computer. Maybe I just compiled it from source I wrote, or maybe it is a random thing I downloaded and unzipped. How does a decision get made on whether my system will run that or not?