[SDCS] How can i like system lock down?

I need trust process can run and call sub-process.

The other process can be deny.

I set the policy content below...

I can deny non-trust process, but can't allow trust process call sub-process.

Such as

cmd.exe is trusted updaters process.

cmd.exe call putty.exe can't be run.

log is deny_ps.

How can i do?

Thanks