In Panther, one thing I've noticed is that some apps automatically open others, which defeats the permissions thing. For example, iTunes, which I let my kids have free access to, automatically launches Safari, which I don't.
The only way to get around this is to move the app into a personal folder. So on the kids' computer, I put Safari into the administrator's personal folder, and they can't access it from their accounts.