Hmm... I see what you're saying. You need to set your script to look recursively at the folders. Almost like a -R modifier. ...maybe post your com.apple.applicationaccess.new file you spoke of in your original post.
Though, I'm not sure there's a way to do what you want.
The level of control that you're looking for is attainable, but I think it's headed towards unreasonable. Or it's at the limit of what's possible. As they say, complex systems become more unstable as they become more complex.
The school that I work at, for instance, has a content filter on the internet connection. It's pretty good, but occasionally we'll have that student that just HAS to get on facebook. I've spoken with the board and the principal and all the powers that be about solutions to the problem. One of them even suggested that we make a list of sites that are acceptable!
When all along, the real problem is the students. We have to teach our students to be responsible with the internet. It's a bit different I'm sure, when working with adults, but if your employees can't be trusted to work instead of wasting time doing their own thing on the computer, then....... You know where this is going.
If you have a basic set of apps that your users need to be using while at work - ie MS Office, Creative Suite, and the basic default apps that come with os x, then that's easy. When a user can't open a program, I think OS X asks for a password to allow it. ...if it doesn't then it's easy enough to take note of which app it is, and add it to the MCX record. (oh yeah..... I tried the printer apps... they seem to open unobstructed even if they're not in the WGM Allow app list)
This may not be reasonable if you have thousands of employees, but it's simple solution. Weigh your time hunting down apps versus how long you've been looking for this solution.
Hope this helps!
