As of Jenkins Security Advisory 2017-10-11 CommandLauncher configuration enforces RUN_SCRIPTS, which is awkward for cases where a lower-privileged user is permitted to configure other aspects of an agent. The launcher should be moved out of core into a plugin that can depend on script-security for a regular approval workflow.