I think this is being approached backwards - both by the article and by commenters here. A Unix account is a viable access control mechanism. If you create one

I think this is being approached backwards - both by the article and by commenters here. A Unix account is a viable access control mechanism. If you create one, you give its human user access to do everything that the Unix user can do. This can be very useful. But others want to give humans users more restricted access than their corresponding Unix account. This is futile, since the Unix account is the basic unit of access control on a Unix or Unix-like system. The author is correct that if you want to do this then you must create a sandbox. General tools won't do, because they're not designed for it, and/or are generally swimming against the tide.