running limited set of commands

Forgive me for the hour is late and the patience is low....

I know I've seen references to how to how procmail respond to  
commands, but that these commands should be limited (ie no  
desstructive commands, rm, etc)

Does anyone have a pointer to a good way to do this?

TjL