1. A computer program product for modifying access to securable objects, the computer program product comprising program instructions stored on a non-transitory computer readable medium, the program instructions to be executed by a processor to perform a method, the method comprising: providing a rule that includes an application-criterion set including at least one criterion for modifying a token of a process during execution of the process in accordance with the rule, wherein the rule specifies at least one group to be added to the token of the process if the process satisfies the application-criterion set, wherein access to securable objects by the process is controlled by an operating system in accordance with the token, and wherein at least one said specified group is a group other than an Administrators group; and before the operating system employs the process's token to determine the process's access to securable objects: making a determination of whether the process satisfies the application-criterion set; and if and only if the determination is affirmative, adding to or removing from the process's token in response to the rule each group or user that the rule specifies.