Back in my day it was easy: Mac OS used the 4-character "creator code" to check what applications your user could open, so you just set the creator code to a kn

Back in my day it was easy: Mac OS used the 4-character "creator code" to check what applications your user could open, so you just set the creator code to a known allowed one and could run anything you want. Of course you don't have access to run ResEdit, so your bring your own copy of that on a flash drive with its creator code already fixed. "RASM" was my go-to. That was the remote access status monitor, and any user account had access to it. For the less technically inclined, you could create a custom "Launch Application" toolbar button in Apple Works (or Claris Works before that). It would give you an error that you don't have permission to launch the application, and then it would open anyway.