you could visualize this. Years ago there was a device that had that technology implemented and was going to be used for Call centers. Never took off, but DS was in the box, along with IDM and IAM was another box in the DMZ. To get out to the intranet or internet, you had to login to the network, passed to DS. IDM solution and only present you with things on your desktop.
Even certain aspects were removed from the client. I was on the verge of doing something like this for all sub divisions around where I lived as I heard from parents wanting something like this from the early 90's.