Users of IIS will no-doubt be familar with the concept of an application scope: which is basically a subtree of the filesystem where any page, script, or executable contained within counts as being part of that "application".
I think the concept can be applied to desktop programs too, where each application's directory under Program Files would be marked as its own application scope, and all executables contained within can run under its own security principal which gives users
more control, remedies problems associated with UAC, and more stuff besides. For instance users might prohibt all programs from editing their files, in case of things like ransomware, or reading files in certain directories (like banking details).
The idea being than an application is freely able to alter the filesystem in its own directory, which means an end to the misuse of the ProgramData directory on Vista/Win7 as a "UAC-free" version of Program Files (which defeats the point of UAC to avoid
program file modification in the first place).
This idea could be combined with an overhauled package management system which makes things easier for program installation, management, security, and uninstallation. Kind of like Apple's .app system, but on steroids.