zabbix executes remote commands by calling a special key, system.run. on the agent side, remote commands can be either fully enabled or disabled.

it would be useful to allow specifying 'allowed commands for system.run' - that way, one could use remote commands while still limiting the agent and not allowing to run any command at all.