Good ideas, but too far from the mainstream

I wrote a system at an old workplace which worked something like this. At 
login it traversed a dependency tree, built a pair of directories full of 
symlinks to binaries and shared libraries under /tmp, and pointed PATH and 
LD_LIBRARY_PATH through it. (It used shell traps to remove the 
directories, although if I'd had root privs I would probably have used PAM 
instead.)

(You could ask for specific binaries or all binaries from specific 
packages, but almost nobody but me ever did that. Most people just turned 
everything off and on when necessary, *sigh*)