Supposedly a user (not a power user but a plain user) can't
install software but apparently this isn't completely true
(I, as a user, was able to load Google Chrome among others).

Generally speaking, what kinds of software can be installed
by a user, how porous is this restriction mechanism?

Is there some kind of policy setting that can tighten up
this restriction?

Is there a way to audit software installs?

Thanks in advance,
eric