Now you must specifically allow command/subcommand/flags which can be
run as externals, in the config file. More tests. More unique exit
codes.