1. A device, comprising: a kernel-mode driver (KMD) configured to receive a command buffer having one or more buffer sections, each command buffer section having a command and designating whether that command is privileged or non-privileged, and the KMD is further configured to selectively parse and validate one or more of the command buffer sections; and a graphics processing unit (GPU) configured to receive batch buffers from the KMD, each batch buffer having a command from the command buffer and designating whether that command is privileged or non-privileged, and the GPU is further configured to disallow execution of any privileged command from a non-privileged batch buffer.