By allowing a user to create "Custom Commands" allows it to run as root and this would have to be restricted.
I think there would be several possibilities:
- Function as in "Scheduled Cron Jobs" that can restrict the running user the command.
- As in "Can create and edit commands?" that allows the user selection.
- As in "Permissions for all modules" / "Users visible in user chooser" that not only works for selection in the "popup" but also restrict to this list when is typed.