{
  executor,
  enable,
  controlGroup,
}:
{ config, lib, ... }:
{
  config = lib.mkIf enable {
    assertions = [
      {
        assertion = lib.all (user: user.uid == null || user.uid < 610000 || user.uid >= 610064) (
          builtins.attrValues config.users.users
        );
        message = "UIDs 610000–610063 are reserved for restricted engine identities.";
      }
    ];
    systemd.tmpfiles.rules = [
      "d /run/quixos-restricted-engines 0711 quixos-graph ${controlGroup} -"
    ];
    security.wrappers.quixos-restricted-engine = {
      source = "${executor.identityLauncher}/bin/quixos-restricted-engine";
      owner = "root";
      group = controlGroup;
      permissions = "u+rx,g+rx,o-rwx";
      setuid = true;
    };
  };
}