1. A method comprising: providing, by a computer system, a rule including an application-criterion set, the application-criterion set comprising at least one criterion for modifying a token of a process during execution of the process in accordance with the rule, the rule specifying at least one group to be added to the token if the process satisfies the application-criterion set, the at least one group being a group other than an administrators group of users having administrative privileges, and wherein access to a securable object by the process is controlled by an operating system in accordance with the token; and before the operating system uses the token to determine access to the securable object by the process: determining during the execution of the process whether the process satisfies the application-criterion set; and in response to determining that the process satisfies the application-criterion set, adding to or removing from the token each group or user that the rule specifies.