Our current config is attached, it only allows users in the "users" group and disables the power and storage subsystems because they are not needed in our case.