Back in mars 2011 I had a conversation on Linux.com a ”Similar way to secure smart phonesand tablets?”. Today this idea best resembles what is known as the mobile device management solution ”Dual persona” on android.
Now. Maybe the time has come for a similar solution on the job PC. An additional virtual installation of the operating system where the employee can install programs not necessarily sanctioned by the company. On the work installation the restrictions are much harder for security purposes. Both would run at the same time. This solution would transform the job laptop into one for work and one for personal use.