Since you only can assign execution attributes on individial programs, you must create wrapper scripts if you want to allow a profile to only use a specific set of arguments for that program.
E.g. if you want to allow the profile "Cron Management" to use svcadm to stop/start/restart svc:/system/cron:default you have to create a wrapper to make sure that the profile only is allowed to operate on that service.
A more generic solution is needed, where you can create execution profiles that can specify which arguments the profile is allowed to use.
xxxxx@xxxxx.com 2004-09-04