Comment by JdeBP

That sort of idea, yes.

I've just done some research and it looks like the Debin Hurd people did attempt to actually implement this. I just never heard about it. There was a 'login shell' and a 'nouser'. The latter had am empty set of IDs, and this case (optionally) switched to an extra set of rwx permission bits that existed specifically for determining 'nouser' access.

* https://groups.google.com/g/linux.debian.ports.hurd/c/2rCbPl...