I like the above with the ability to also detect any change in the executable since the last time the allow/deny policy was set (for that...
Separate names with a comma.