Back in my SA days...
...not too long ago, I usually tailored what was allowed and what wasn't depending on the environment and the users. My two biggest SA jobs were at software development companies were I was mostly dealing with developers. Some good (they were given quite a bit of leeway), some bad (next to no leeway) and some neutral. With production and some development servers I kept a lid on what could be done and anything to be added, changed, etc. went through me since anything done could affect most of the staff. In most cases those additions or changes were no problem.
The developers usually had Sun workstations at their desk that they had free reign to if they so desired knowing that if they did something to it which screwed something up and I couldn't fix it fairly quickly, the system would get reinstalled via jumpstart. Any window manager was fine, any tool, or even using local workstation storage with the knowledge that it was never backed up. Certainly any other OS would have been okay as long as they understood that there wouldn't be expert support of it for a while at least.
