I know I can restrict access to specific commands using authentication, but can I restrict access to individual arguments of a command?

For example there are many snooze commands for the various data items, based on the exit condition for the snooze 

But what if you just want to remove the ability to snooze on all Managed Entities rather than the whole 'Until severity changes' snooze command?  the solution basically involves removing the permission to the AllMe options and re-instating them as new commands which execute the single instance options. An example of the XML is included below:

Figure 1 - example XML 

This example in figure 1 shows a User account with the AllMe options removed and a new commandGroup which re-instates their single instance equivalents onto the xpaths where they didn't exist before.  The only exception to this is the /SNOOZE:untilValueChanges command where there doesn't appear to be a single instance option, so this one selection still throws up the option for all managed entities. 

 Removing the popups

You can improve on this further by removing the popup which appears each time (if this is undesirable). It works on all snooze commands including the /SNOOZE:untilValueChanges. The solution is basically the same in that the User permissioning section applies none to all the AllMe commands, but instead of creating your own commands which invoke the single instance option, you create your own commands that invoke the same ALLMe ones again, but this time provide the answer to the argument as 'this' i.e it forces it to use the first 'this managed entity only' argument.  If you have tried this already you will notice that an annoying pop up output window appears. This can also be prevented by ticking 'silent' 

An example for the snooze manual command is below.  You  need to go to the GSE help and look at "Appendix C: Internal Commands" to check which argument number to provide the selection of 'this' to as it isn't always argument 5 (e.g snooze timeAllMe takes 'this' as argument 6)