> ...so make it its own security principal, distinct from the human user?

That presumes the existence of a security context, which this product provides. Where do you configure the security principal otherwise?

Windows already has a multi-user security context, with file- and API-level permissioning. We often call it “Users” or “RBAC”. I’ve read it and I’m still not sure what I can do now that I couldn’t a week ago.