Set up a separate account to do software installs. For example, define it as acct swinstall. Use the tsh command to run a trusted command interpreter. The 'shell' command exits the tsh state. Extended ACL is what these commands give.
Any user can create an extended ACL for any file they own.
User AND Group must match. Default AIX file permissions are 644 for files and 755 for dirs. AIX allows only root to use the 'chown' command. Do not use UUCP unless absolutely necessary. Consider implementing disk quotas on your systems.