{
  executor,
  enable,
  controlGroup,
  authorityUser ? "quixos-graph",
  engineDirectory ? "/run/quixos-restricted-engines",
  firstUid ? 610000,
  identityCount ? 64,
  wrapperName ? "quixos-restricted-engine",
}:
{ config, lib, ... }:
{
  config = lib.mkIf enable {
    assertions = [
      {
        assertion = lib.all (
          user: user.uid == null || user.uid < firstUid || user.uid >= firstUid + identityCount
        ) (builtins.attrValues config.users.users);
        message = "UIDs ${toString firstUid}–${
          toString (firstUid + identityCount - 1)
        } are reserved for restricted engine identities.";
      }
      {
        assertion = lib.all (
          group: group.gid == null || group.gid < firstUid || group.gid >= firstUid + identityCount
        ) (builtins.attrValues config.users.groups);
        message = "Restricted engine GIDs must not overlap host groups.";
      }
    ];
    systemd.tmpfiles.rules = [
      "d ${engineDirectory} 0711 ${authorityUser} ${controlGroup} -"
    ];
    security.wrappers.${wrapperName} = {
      source = "${
        executor.mkIdentityLauncher {
          inherit
            authorityUser
            engineDirectory
            firstUid
            identityCount
            ;
        }
      }/bin/quixos-restricted-engine";
      owner = "root";
      group = controlGroup;
      permissions = "u+rx,g+rx,o-rwx";
      setuid = true;
    };
  };
}