File attributes will help. BSDs have the ability to assign extra attributes to files and directories (Linux has similar features, but who uses Linux in a secure environment? Ok! take it easy, it's a joke... but still use OpenBSD, please). This is different from the standard Unix permissions scheme in that the attributes set on a file apply universally to all users of the system, and they affect file accesses at a much deeper level than file permissions or ACLs.