GNU Guix launches

Just like it's possible to disable many features, like a user being able to write to /etc/passwd, it's possible to disallow users from running the package manager in a way that does not suit policy even if it is technically capable of doing so. There is no need to limit the implementation of a feature, just because someone does not want or need it.