Perhaps add a hook here where commandfiles can reject non-whitelisted commands. Document it in api.drush.inc. Adding a hook is a one line call to http://api.drush.org/api/drush/includes%21command.inc/function/drush_command_invoke_all/master