Transport-level protocols in user space

A) run-time control, e.g.: root permission, cgroups, firewalls, etc.
B) "build/install control", sorry for the lack of a better term. e.g.: choosing which application to trust and install, a.k.a: "is there an app for that?"

> One of the OS's important jobs is to police that...

Yet is is, and this can be type of control/freedom A.

> ... on behalf of the user.

... on behalf of the *administrator*.

Freedom A obviously did not exist on multi-user systems. Now that everyone has a single-user computer in their pocket you'd think people have it. Except not because it's way too technical and complicated and scary, so all users besides geeks still want someone else to manage this on their behalf: see the massive success of secure/verified boot, DRMs, managed set-up boxes, etc.[*]. So nice theory but was never really practised on a wide scale. In practice the OS is owned just like the rest of the network is.

This leaves only freedom B as a (admittedly limited) type of control for most users.

[*] now add Linux TCP/IP maintainers to that list?