Splitting areas of responsibility

[Martin, Jason H]

Hello, has anyone accomplished partitioning areas of responsibility
within CFEngine? Say host X has applications A, B, and C each running as
a separate user  Each application has a different support group (all
separate from the root SA of the box) that wants to manage their app via
CFEngine, but they are not authorized to make changes to anything for
which their user has no privileges.

Does anyone have any experience with this sort of situation? Is there
any way to have CFE run as a particular non-root user (presumably once
per user in question) and execute a different config file for each? Or,
is there any trick to allowing someone to write a config file that can't
make any root-level changes?

Thank you,
-Jason Martin