points
It seems as if approved guest access now == system-wide access (at the hardware level). User compartmentalization no longer works.