Early in my IT support career I learned that a way past O/S security constraints was to treat the media as data to a different O/S.
In my early days our mainframe ran several different O/S types depending on the jobs. The operators would prime the configured O/S from tape to the disk as the need arose during the day.
The new disk O/S had a bug that it would not create new users properly. I found that I could use the system tape as data to a program on another O/S - and add a few blocks containing new users' information.