Wouldn't it make more sense to use [CapabilityBoundingSet=](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#CapabilityBoundingSet=) instead and keep it running as guam user?