I've looked around and not been able to find an answer for this on Windows 7 Platform. This pertains to Securing data files.
The basic idea is that files should not be permitted to be modified by the user directly. Only through the use of an designated application can it be modified (Thus Indirectly). The idea is that the Designated Application contains its own authentication, access control and audit logs and can manipulate the contents of the data files and keep a log of the changes it made to the data files.
Here are some illustrations.
There is a directory D to which the User U has no access.
The user U uses Application A to generate data files F1,f2,F3 which the application writes into Directory D.
This illustrates the point that the user can only write into Directory D using Application A to create data files, F1,F2,F3,Fn
If the User U uses Windows explorer (or similar) to rename/delete these files F1,F2,F3,Fn in Directory D, he will be denied access.
If the User U uses Windows explorer (or similar) to read these files F1,F2,F3,Fn in Directory D, he will be denied access. He has to use Application A to read and view these files within Application A.
The only solution that I have found it to elevate privileges using runas with /savecred (admin credentials) but my understanding is that this raises the possiblity of the user using the saved credentials to run some other program (say CMD) and gain unprivileged access to the data files F1,F2,Fn in Directory D
Finally note that this is a Windows 7 Pro Edition which is running in a workgroup.
PS: I have access to admin and can setup the PC as required.