diff --git a/libmalcontent-ui/malcontent-ui.gresource.xml b/libmalcontent-ui/malcontent-ui.gresource.xml
index cbdaa9f..089d8a5 100644
--- a/libmalcontent-ui/malcontent-ui.gresource.xml
+++ b/libmalcontent-ui/malcontent-ui.gresource.xml
@@ -4,6 +4,7 @@
   <gresource prefix="/org/freedesktop/MalcontentUi/ui">
     <file preprocess="xml-stripblanks">restrict-applications-dialog.ui</file>
     <file preprocess="xml-stripblanks">restrict-applications-selector.ui</file>
+    <file>restricts-switch.css</file>
     <file preprocess="xml-stripblanks">user-controls.ui</file>
   </gresource>
 </gresources>
diff --git a/libmalcontent-ui/restrict-applications-dialog.c b/libmalcontent-ui/restrict-applications-dialog.c
index d231466..ed70c19 100644
--- a/libmalcontent-ui/restrict-applications-dialog.c
+++ b/libmalcontent-ui/restrict-applications-dialog.c
@@ -217,7 +217,7 @@ update_description (MctRestrictApplicationsDialog *self)
     }
 
   /* Translators: the placeholder is a user’s full name */
-  description = g_strdup_printf (_("Allow %s to use the following installed applications."),
+  description = g_strdup_printf (_("Restrict %s from using the following installed applications."),
                                  self->user_display_name);
   gtk_label_set_text (self->description, description);
   gtk_widget_show (GTK_WIDGET (self->description));
diff --git a/libmalcontent-ui/restrict-applications-dialog.ui b/libmalcontent-ui/restrict-applications-dialog.ui
index e95ff36..b0ebf15 100644
--- a/libmalcontent-ui/restrict-applications-dialog.ui
+++ b/libmalcontent-ui/restrict-applications-dialog.ui
@@ -22,8 +22,13 @@
         <child>
           <object class="GtkLabel" id="description">
             <!-- Translated dynamically: -->
-            <property name="label">Allow {username} to use the following installed applications.</property>
+            <property name="label">Restrict {username} from using the following installed applications.</property>
             <property name="visible">False</property>
+            <property name="ellipsize">none</property>
+            <property name="wrap">True</property>
+            <property name="halign">start</property>
+            <property name="xalign">0</property>
+            <property name="hexpand">True</property>
             <child internal-child="accessible">
               <object class="AtkObject">
                 <property name="accessible-role">static</property>
diff --git a/libmalcontent-ui/restrict-applications-selector.c b/libmalcontent-ui/restrict-applications-selector.c
index b203bee..a38d1ae 100644
--- a/libmalcontent-ui/restrict-applications-selector.c
+++ b/libmalcontent-ui/restrict-applications-selector.c
@@ -68,6 +68,8 @@ struct _MctRestrictApplicationsSelector
 
   FlatpakInstallation *system_installation; /* (owned) */
   FlatpakInstallation *user_installation; /* (owned) */
+
+  GtkCssProvider *css_provider;  /* (owned) */
 };
 
 G_DEFINE_TYPE (MctRestrictApplicationsSelector, mct_restrict_applications_selector, GTK_TYPE_BOX)
@@ -157,6 +159,7 @@ mct_restrict_applications_selector_dispose (GObject *object)
   g_clear_pointer (&self->app_filter, mct_app_filter_unref);
   g_clear_object (&self->system_installation);
   g_clear_object (&self->user_installation);
+  g_clear_object (&self->css_provider);
 
   G_OBJECT_CLASS (mct_restrict_applications_selector_parent_class)->dispose (object);
 }
@@ -239,6 +242,10 @@ mct_restrict_applications_selector_init (MctRestrictApplicationsSelector *self)
 
   self->system_installation = flatpak_installation_new_system (NULL, NULL);
   self->user_installation = flatpak_installation_new_user (NULL, NULL);
+
+  self->css_provider = gtk_css_provider_new ();
+  gtk_css_provider_load_from_resource (self->css_provider,
+                                       "/org/freedesktop/MalcontentUi/ui/restricts-switch.css");
 }
 
 static void
@@ -251,7 +258,7 @@ on_switch_active_changed_cb (GtkSwitch  *s,
   gboolean allowed;
 
   app = g_object_get_data (G_OBJECT (s), "GAppInfo");
-  allowed = gtk_switch_get_active (s);
+  allowed = !gtk_switch_get_active (s);
 
   if (allowed)
     {
@@ -286,6 +293,7 @@ create_row_for_app_cb (gpointer item,
   gboolean allowed;
   const gchar *app_name;
   gint size;
+  GtkStyleContext *context;
 
   app_name = g_app_info_get_name (app);
 
@@ -319,6 +327,11 @@ create_row_for_app_cb (gpointer item,
   w = g_object_new (GTK_TYPE_SWITCH,
                     "valign", GTK_ALIGN_CENTER,
                     NULL);
+  context = gtk_widget_get_style_context (w);
+  gtk_style_context_add_class (context, "restricts");
+  gtk_style_context_add_provider (context,
+                                  GTK_STYLE_PROVIDER (self->css_provider),
+                                  GTK_STYLE_PROVIDER_PRIORITY_APPLICATION - 1);
   gtk_container_add (GTK_CONTAINER (box), w);
 
   gtk_widget_show_all (box);
@@ -326,7 +339,7 @@ create_row_for_app_cb (gpointer item,
   /* Fetch status from AccountService */
   allowed = mct_app_filter_is_appinfo_allowed (self->app_filter, app);
 
-  gtk_switch_set_active (GTK_SWITCH (w), allowed);
+  gtk_switch_set_active (GTK_SWITCH (w), !allowed);
   g_object_set_data_full (G_OBJECT (w), "GAppInfo", g_object_ref (app), g_object_unref);
 
   if (allowed)
diff --git a/libmalcontent-ui/restricts-switch.css b/libmalcontent-ui/restricts-switch.css
new file mode 100644
index 0000000..3bf85ae
--- /dev/null
+++ b/libmalcontent-ui/restricts-switch.css
@@ -0,0 +1,18 @@
+/* FIXME: This ‘negative’ variant of a GtkSwitch should probably be
+ * upstreamed to GTK. See https://gitlab.gnome.org/GNOME/gtk/issues/2470 */
+switch:checked.restricts {
+  background-color: #fffd33;
+}
+
+switch:checked.restricts, switch:checked.restricts slider {
+  border-color: #ffd52b;
+}
+
+switch:disabled.restricts {
+  border-color: @borders;
+  background-color: @insensitive_bg_color;
+}
+
+switch:disabled.restricts slider {
+  border-color: #bfb8b1;
+}
diff --git a/libmalcontent-ui/user-controls.c b/libmalcontent-ui/user-controls.c
index 20ab0ba..a4ff30d 100644
--- a/libmalcontent-ui/user-controls.c
+++ b/libmalcontent-ui/user-controls.c
@@ -75,12 +75,20 @@ struct _MctUserControls
   GtkGrid     parent_instance;
 
   GMenu      *age_menu;
-  GtkSwitch  *allow_system_installation_switch;
-  GtkSwitch  *allow_user_installation_switch;
-  GtkSwitch  *allow_web_browsers_switch;
-  GtkButton  *restriction_button;
-  GtkPopover *restriction_popover;
+  GtkSwitch  *restrict_system_installation_switch;
+  GtkLabel   *restrict_system_installation_description;
+  GtkSwitch  *restrict_user_installation_switch;
+  GtkLabel   *restrict_user_installation_description;
+  GtkSwitch  *restrict_web_browsers_switch;
+  GtkLabel   *restrict_web_browsers_description;
+  GtkButton  *oars_button;
+  GtkLabel   *oars_button_label;
+  GtkPopover *oars_popover;
   MctRestrictApplicationsDialog *restrict_applications_dialog;
+  GtkLabel   *restrict_applications_description;
+
+  GtkListBox *application_usage_permissions_listbox;
+  GtkListBox *software_installation_permissions_listbox;
 
   GSimpleActionGroup *action_group; /* (owned) */
 
@@ -104,13 +112,13 @@ struct _MctUserControls
 
 static gboolean blacklist_apps_cb (gpointer data);
 
-static void on_allow_installation_switch_active_changed_cb (GtkSwitch        *s,
-                                                            GParamSpec       *pspec,
-                                                            MctUserControls *self);
+static void on_restrict_installation_switch_active_changed_cb (GtkSwitch        *s,
+                                                               GParamSpec       *pspec,
+                                                               MctUserControls *self);
 
-static void on_allow_web_browsers_switch_active_changed_cb (GtkSwitch        *s,
-                                                            GParamSpec       *pspec,
-                                                            MctUserControls *self);
+static void on_restrict_web_browsers_switch_active_changed_cb (GtkSwitch        *s,
+                                                               GParamSpec       *pspec,
+                                                               MctUserControls *self);
 
 static void on_restrict_applications_button_clicked_cb (GtkButton *button,
                                                         gpointer   user_data);
@@ -392,14 +400,14 @@ update_oars_level (MctUserControls *self)
   if (rating_age_category == NULL || all_categories_unset)
     rating_age_category = _("All Ages");
 
-  gtk_button_set_label (self->restriction_button, rating_age_category);
+  gtk_label_set_label (self->oars_button_label, rating_age_category);
 }
 
 static void
 update_allow_app_installation (MctUserControls *self)
 {
-  gboolean allow_system_installation;
-  gboolean allow_user_installation;
+  gboolean restrict_system_installation;
+  gboolean restrict_user_installation;
   gboolean non_admin_user = TRUE;
 
   if (self->user_account_type == ACT_USER_ACCOUNT_TYPE_ADMINISTRATOR)
@@ -407,8 +415,8 @@ update_allow_app_installation (MctUserControls *self)
 
   /* Admins are always allowed to install apps for all users. This behaviour is governed
    * by flatpak polkit rules. Hence, these hide these defunct switches for admins. */
-  gtk_widget_set_visible (GTK_WIDGET (self->allow_system_installation_switch), non_admin_user);
-  gtk_widget_set_visible (GTK_WIDGET (self->allow_user_installation_switch), non_admin_user);
+  gtk_widget_set_visible (GTK_WIDGET (self->restrict_system_installation_switch), non_admin_user);
+  gtk_widget_set_visible (GTK_WIDGET (self->restrict_user_installation_switch), non_admin_user);
 
   /* If user is admin, we are done here, bail out. */
   if (!non_admin_user)
@@ -418,60 +426,86 @@ update_allow_app_installation (MctUserControls *self)
       return;
     }
 
-  allow_system_installation = mct_app_filter_is_system_installation_allowed (self->filter);
-  allow_user_installation = mct_app_filter_is_user_installation_allowed (self->filter);
+  restrict_system_installation = !mct_app_filter_is_system_installation_allowed (self->filter);
+  restrict_user_installation = !mct_app_filter_is_user_installation_allowed (self->filter);
 
   /* While the underlying permissions storage allows the system and user settings
    * to be stored completely independently, force the system setting to OFF if
    * the user setting is OFF in the UI. This keeps the policy in use for most
    * people simpler. */
-  if (!allow_user_installation)
-    allow_system_installation = FALSE;
+  if (restrict_user_installation)
+    restrict_system_installation = TRUE;
 
-  g_signal_handlers_block_by_func (self->allow_system_installation_switch,
-                                   on_allow_installation_switch_active_changed_cb,
+  g_signal_handlers_block_by_func (self->restrict_system_installation_switch,
+                                   on_restrict_installation_switch_active_changed_cb,
                                    self);
 
-  g_signal_handlers_block_by_func (self->allow_user_installation_switch,
-                                   on_allow_installation_switch_active_changed_cb,
+  g_signal_handlers_block_by_func (self->restrict_user_installation_switch,
+                                   on_restrict_installation_switch_active_changed_cb,
                                    self);
 
-  gtk_switch_set_active (self->allow_system_installation_switch, allow_system_installation);
-  gtk_switch_set_active (self->allow_user_installation_switch, allow_user_installation);
+  gtk_switch_set_active (self->restrict_system_installation_switch, restrict_system_installation);
+  gtk_switch_set_active (self->restrict_user_installation_switch, restrict_user_installation);
 
-  g_debug ("Allow system installation: %s", allow_system_installation ? "yes" : "no");
-  g_debug ("Allow user installation: %s", allow_user_installation ? "yes" : "no");
+  g_debug ("Restrict system installation: %s", restrict_system_installation ? "yes" : "no");
+  g_debug ("Restrict user installation: %s", restrict_user_installation ? "yes" : "no");
 
-  g_signal_handlers_unblock_by_func (self->allow_system_installation_switch,
-                                     on_allow_installation_switch_active_changed_cb,
+  g_signal_handlers_unblock_by_func (self->restrict_system_installation_switch,
+                                     on_restrict_installation_switch_active_changed_cb,
                                      self);
 
-  g_signal_handlers_unblock_by_func (self->allow_user_installation_switch,
-                                     on_allow_installation_switch_active_changed_cb,
+  g_signal_handlers_unblock_by_func (self->restrict_user_installation_switch,
+                                     on_restrict_installation_switch_active_changed_cb,
                                      self);
 }
 
 static void
-update_allow_web_browsers (MctUserControls *self)
+update_restrict_web_browsers (MctUserControls *self)
 {
-  gboolean allow_web_browsers;
+  gboolean restrict_web_browsers;
 
-  allow_web_browsers = mct_app_filter_is_content_type_allowed (self->filter,
-                                                               WEB_BROWSERS_CONTENT_TYPE);
+  restrict_web_browsers = !mct_app_filter_is_content_type_allowed (self->filter,
+                                                                   WEB_BROWSERS_CONTENT_TYPE);
 
-  g_signal_handlers_block_by_func (self->allow_web_browsers_switch,
-                                   on_allow_web_browsers_switch_active_changed_cb,
+  g_signal_handlers_block_by_func (self->restrict_web_browsers_switch,
+                                   on_restrict_web_browsers_switch_active_changed_cb,
                                    self);
 
-  gtk_switch_set_active (self->allow_web_browsers_switch, allow_web_browsers);
+  gtk_switch_set_active (self->restrict_web_browsers_switch, restrict_web_browsers);
 
-  g_debug ("Allow web browsers: %s", allow_web_browsers ? "yes" : "no");
+  g_debug ("Restrict web browsers: %s", restrict_web_browsers ? "yes" : "no");
 
-  g_signal_handlers_unblock_by_func (self->allow_web_browsers_switch,
-                                     on_allow_web_browsers_switch_active_changed_cb,
+  g_signal_handlers_unblock_by_func (self->restrict_web_browsers_switch,
+                                     on_restrict_web_browsers_switch_active_changed_cb,
                                      self);
 }
 
+static void
+update_labels_from_name (MctUserControls *self)
+{
+  g_autofree gchar *l = NULL;
+
+  /* Translators: The placeholder is a user’s display name. */
+  l = g_strdup_printf (_("Prevents %s from running web browsers. Note that limited web content may still be available in other applications."), self->user_display_name);
+  gtk_label_set_label (self->restrict_web_browsers_description, l);
+  g_clear_pointer (&l, g_free);
+
+  /* Translators: The placeholder is a user’s display name. */
+  l = g_strdup_printf (_("Prevents specified applications from being used by %s."), self->user_display_name);
+  gtk_label_set_label (self->restrict_applications_description, l);
+  g_clear_pointer (&l, g_free);
+
+  /* Translators: The placeholder is a user’s display name. */
+  l = g_strdup_printf (_("Prevents %s from installing applications."), self->user_display_name);
+  gtk_label_set_label (self->restrict_user_installation_description, l);
+  g_clear_pointer (&l, g_free);
+
+  /* Translators: The placeholder is a user’s display name. */
+  l = g_strdup_printf (_("Prevents %s’s application installations from being available to all users."), self->user_display_name);
+  gtk_label_set_label (self->restrict_system_installation_description, l);
+  g_clear_pointer (&l, g_free);
+}
+
 static void
 setup_parental_control_settings (MctUserControls *self)
 {
@@ -494,7 +528,8 @@ setup_parental_control_settings (MctUserControls *self)
   update_oars_level (self);
   update_categories_from_language (self);
   update_allow_app_installation (self);
-  update_allow_web_browsers (self);
+  update_restrict_web_browsers (self);
+  update_labels_from_name (self);
 }
 
 /* Callbacks */
@@ -536,21 +571,21 @@ blacklist_apps_cb (gpointer data)
 }
 
 static void
-on_allow_installation_switch_active_changed_cb (GtkSwitch        *s,
-                                                GParamSpec       *pspec,
-                                                MctUserControls *self)
+on_restrict_installation_switch_active_changed_cb (GtkSwitch        *s,
+                                                   GParamSpec       *pspec,
+                                                   MctUserControls *self)
 {
   /* See the comment about policy in update_allow_app_installation(). */
-  if (s == self->allow_user_installation_switch &&
-      !gtk_switch_get_active (s) &&
-      gtk_switch_get_active (self->allow_system_installation_switch))
+  if (s == self->restrict_user_installation_switch &&
+      gtk_switch_get_active (s) &&
+      !gtk_switch_get_active (self->restrict_system_installation_switch))
     {
-      g_signal_handlers_block_by_func (self->allow_system_installation_switch,
-                                       on_allow_installation_switch_active_changed_cb,
+      g_signal_handlers_block_by_func (self->restrict_system_installation_switch,
+                                       on_restrict_installation_switch_active_changed_cb,
                                        self);
-      gtk_switch_set_active (self->allow_system_installation_switch, FALSE);
-      g_signal_handlers_unblock_by_func (self->allow_system_installation_switch,
-                                         on_allow_installation_switch_active_changed_cb,
+      gtk_switch_set_active (self->restrict_system_installation_switch, TRUE);
+      g_signal_handlers_unblock_by_func (self->restrict_system_installation_switch,
+                                         on_restrict_installation_switch_active_changed_cb,
                                          self);
     }
 
@@ -559,9 +594,9 @@ on_allow_installation_switch_active_changed_cb (GtkSwitch        *s,
 }
 
 static void
-on_allow_web_browsers_switch_active_changed_cb (GtkSwitch        *s,
-                                                GParamSpec       *pspec,
-                                                MctUserControls *self)
+on_restrict_web_browsers_switch_active_changed_cb (GtkSwitch        *s,
+                                                   GParamSpec       *pspec,
+                                                   MctUserControls *self)
 {
   /* Save the changes. */
   schedule_update_blacklisted_apps (self);
@@ -636,13 +671,13 @@ on_set_age_action_activated (GSimpleAction *action,
 
   /* Update the button */
   if (age == oars_disabled_age)
-    gtk_button_set_label (self->restriction_button, _("All Ages"));
+    gtk_label_set_label (self->oars_button_label, _("All Ages"));
 
   for (i = 0; age != oars_disabled_age && entries[i] != NULL; i++)
     {
       if (ages[i] == age)
         {
-          gtk_button_set_label (self->restriction_button, entries[i]);
+          gtk_label_set_label (self->oars_button_label, entries[i]);
           break;
         }
     }
@@ -659,6 +694,28 @@ on_set_age_action_activated (GSimpleAction *action,
   schedule_update_blacklisted_apps (self);
 }
 
+static void
+list_box_header_func (GtkListBoxRow *row,
+                      GtkListBoxRow *before,
+                      gpointer       user_data)
+{
+  GtkWidget *current;
+
+  if (before == NULL)
+    {
+      gtk_list_box_row_set_header (row, NULL);
+      return;
+    }
+
+  current = gtk_list_box_row_get_header (row);
+  if (current == NULL)
+    {
+      current = gtk_separator_new (GTK_ORIENTATION_HORIZONTAL);
+      gtk_widget_show (current);
+      gtk_list_box_row_set_header (row, current);
+    }
+}
+
 /* GObject overrides */
 
 static void
@@ -903,15 +960,22 @@ mct_user_controls_class_init (MctUserControlsClass *klass)
   gtk_widget_class_set_template_from_resource (widget_class, "/org/freedesktop/MalcontentUi/ui/user-controls.ui");
 
   gtk_widget_class_bind_template_child (widget_class, MctUserControls, age_menu);
-  gtk_widget_class_bind_template_child (widget_class, MctUserControls, allow_system_installation_switch);
-  gtk_widget_class_bind_template_child (widget_class, MctUserControls, allow_user_installation_switch);
-  gtk_widget_class_bind_template_child (widget_class, MctUserControls, allow_web_browsers_switch);
-  gtk_widget_class_bind_template_child (widget_class, MctUserControls, restriction_button);
-  gtk_widget_class_bind_template_child (widget_class, MctUserControls, restriction_popover);
+  gtk_widget_class_bind_template_child (widget_class, MctUserControls, restrict_system_installation_switch);
+  gtk_widget_class_bind_template_child (widget_class, MctUserControls, restrict_system_installation_description);
+  gtk_widget_class_bind_template_child (widget_class, MctUserControls, restrict_user_installation_switch);
+  gtk_widget_class_bind_template_child (widget_class, MctUserControls, restrict_user_installation_description);
+  gtk_widget_class_bind_template_child (widget_class, MctUserControls, restrict_web_browsers_switch);
+  gtk_widget_class_bind_template_child (widget_class, MctUserControls, restrict_web_browsers_description);
+  gtk_widget_class_bind_template_child (widget_class, MctUserControls, oars_button);
+  gtk_widget_class_bind_template_child (widget_class, MctUserControls, oars_button_label);
+  gtk_widget_class_bind_template_child (widget_class, MctUserControls, oars_popover);
   gtk_widget_class_bind_template_child (widget_class, MctUserControls, restrict_applications_dialog);
+  gtk_widget_class_bind_template_child (widget_class, MctUserControls, restrict_applications_description);
+  gtk_widget_class_bind_template_child (widget_class, MctUserControls, application_usage_permissions_listbox);
+  gtk_widget_class_bind_template_child (widget_class, MctUserControls, software_installation_permissions_listbox);
 
-  gtk_widget_class_bind_template_callback (widget_class, on_allow_installation_switch_active_changed_cb);
-  gtk_widget_class_bind_template_callback (widget_class, on_allow_web_browsers_switch_active_changed_cb);
+  gtk_widget_class_bind_template_callback (widget_class, on_restrict_installation_switch_active_changed_cb);
+  gtk_widget_class_bind_template_callback (widget_class, on_restrict_web_browsers_switch_active_changed_cb);
   gtk_widget_class_bind_template_callback (widget_class, on_restrict_applications_button_clicked_cb);
   gtk_widget_class_bind_template_callback (widget_class, on_restrict_applications_dialog_delete_event_cb);
   gtk_widget_class_bind_template_callback (widget_class, on_restrict_applications_dialog_response_cb);
@@ -922,12 +986,20 @@ mct_user_controls_init (MctUserControls *self)
 {
   g_autoptr(GDBusConnection) system_bus = NULL;
   g_autoptr(GError) error = NULL;
+  g_autoptr(GtkCssProvider) provider = NULL;
 
   /* Ensure the types used in the UI are registered. */
   g_type_ensure (MCT_TYPE_RESTRICT_APPLICATIONS_DIALOG);
 
   gtk_widget_init_template (GTK_WIDGET (self));
 
+  provider = gtk_css_provider_new ();
+  gtk_css_provider_load_from_resource (provider,
+                                       "/org/freedesktop/MalcontentUi/ui/restricts-switch.css");
+  gtk_style_context_add_provider_for_screen (gdk_screen_get_default (),
+                                             GTK_STYLE_PROVIDER (provider),
+                                             GTK_STYLE_PROVIDER_PRIORITY_APPLICATION - 1);
+
   self->selected_age = (guint) -1;
 
   self->cancellable = g_cancellable_new ();
@@ -952,11 +1024,17 @@ mct_user_controls_init (MctUserControls *self)
                                   "permissions",
                                   G_ACTION_GROUP (self->action_group));
 
-  gtk_popover_bind_model (self->restriction_popover, G_MENU_MODEL (self->age_menu), NULL);
+  gtk_popover_bind_model (self->oars_popover, G_MENU_MODEL (self->age_menu), NULL);
 
-  g_object_bind_property (self->allow_user_installation_switch, "active",
-                          self->allow_system_installation_switch, "sensitive",
-                          G_BINDING_DEFAULT);
+  g_object_bind_property (self->restrict_user_installation_switch, "active",
+                          self->restrict_system_installation_switch, "sensitive",
+                          G_BINDING_DEFAULT | G_BINDING_INVERT_BOOLEAN);
+
+  /* Automatically add separators between rows. */
+  gtk_list_box_set_header_func (self->application_usage_permissions_listbox,
+                                list_box_header_func, NULL, NULL);
+  gtk_list_box_set_header_func (self->software_installation_permissions_listbox,
+                                list_box_header_func, NULL, NULL);
 }
 
 /**
@@ -1313,7 +1391,7 @@ void
 mct_user_controls_build_app_filter (MctUserControls     *self,
                                     MctAppFilterBuilder *builder)
 {
-  gboolean allow_web_browsers;
+  gboolean restrict_web_browsers;
   gsize i;
 
   g_return_if_fail (MCT_IS_USER_CONTROLS (self));
@@ -1348,26 +1426,26 @@ mct_user_controls_build_app_filter (MctUserControls     *self,
     }
 
   /* Web browsers */
-  allow_web_browsers = gtk_switch_get_active (self->allow_web_browsers_switch);
+  restrict_web_browsers = gtk_switch_get_active (self->restrict_web_browsers_switch);
 
-  g_debug ("\t → %s web browsers", allow_web_browsers ? "Enabling" : "Disabling");
+  g_debug ("\t → %s web browsers", restrict_web_browsers ? "Restricting" : "Allowing");
 
-  if (!allow_web_browsers)
+  if (restrict_web_browsers)
     mct_app_filter_builder_blacklist_content_type (builder, WEB_BROWSERS_CONTENT_TYPE);
 
   /* App installation */
   if (self->user_account_type != ACT_USER_ACCOUNT_TYPE_ADMINISTRATOR)
     {
-      gboolean allow_system_installation;
-      gboolean allow_user_installation;
+      gboolean restrict_system_installation;
+      gboolean restrict_user_installation;
 
-      allow_system_installation = gtk_switch_get_active (self->allow_system_installation_switch);
-      allow_user_installation = gtk_switch_get_active (self->allow_user_installation_switch);
+      restrict_system_installation = gtk_switch_get_active (self->restrict_system_installation_switch);
+      restrict_user_installation = gtk_switch_get_active (self->restrict_user_installation_switch);
 
-      g_debug ("\t → %s system installation", allow_system_installation ? "Enabling" : "Disabling");
-      g_debug ("\t → %s user installation", allow_user_installation ? "Enabling" : "Disabling");
+      g_debug ("\t → %s system installation", restrict_system_installation ? "Restricting" : "Allowing");
+      g_debug ("\t → %s user installation", restrict_user_installation ? "Restricting" : "Allowing");
 
-      mct_app_filter_builder_set_allow_user_installation (builder, allow_user_installation);
-      mct_app_filter_builder_set_allow_system_installation (builder, allow_system_installation);
+      mct_app_filter_builder_set_allow_user_installation (builder, !restrict_user_installation);
+      mct_app_filter_builder_set_allow_system_installation (builder, !restrict_system_installation);
     }
 }
diff --git a/libmalcontent-ui/user-controls.ui b/libmalcontent-ui/user-controls.ui
index 4042174..703ab66 100644
--- a/libmalcontent-ui/user-controls.ui
+++ b/libmalcontent-ui/user-controls.ui
@@ -33,7 +33,7 @@
         <property name="label_xalign">0</property>
         <property name="shadow_type">in</property>
         <child>
-          <object class="GtkListBox">
+          <object class="GtkListBox" id="application_usage_permissions_listbox">
             <property name="visible">True</property>
             <property name="can_focus">False</property>
             <property name="hexpand">True</property>
@@ -57,18 +57,18 @@
                     <property name="row-spacing">4</property>
                     <property name="column-spacing">4</property>
                     <child>
-                      <object class="GtkLabel" id="allow_web_browsers_label">
+                      <object class="GtkLabel" id="restrict_web_browsers_label">
                         <property name="visible">True</property>
                         <property name="can_focus">False</property>
                         <property name="halign">start</property>
                         <property name="hexpand">True</property>
                         <property name="ellipsize">end</property>
                         <property name="xalign">0</property>
-                        <property name="label" translatable="yes">Allow _Web Browsers</property>
+                        <property name="label" translatable="yes">Restrict _Web Browsers</property>
                         <property name="use_underline">True</property>
-                        <property name="mnemonic_widget">allow_web_browsers_switch</property>
+                        <property name="mnemonic_widget">restrict_web_browsers_switch</property>
                         <accessibility>
-                          <relation target="allow_web_browsers_switch" type="label-for"/>
+                          <relation target="restrict_web_browsers_switch" type="label-for"/>
                         </accessibility>
                       </object>
                       <packing>
@@ -77,14 +77,16 @@
                       </packing>
                     </child>
                     <child>
-                      <object class="GtkLabel" id="allow_web_browsers_description">
+                      <object class="GtkLabel" id="restrict_web_browsers_description">
                         <property name="visible">True</property>
                         <property name="can_focus">False</property>
                         <property name="halign">start</property>
                         <property name="hexpand">True</property>
-                        <property name="ellipsize">end</property>
+                        <property name="ellipsize">none</property>
+                        <property name="wrap">True</property>
                         <property name="xalign">0</property>
-                        <property name="label" translatable="yes">Prevents the user from running web browsers, but limited web content may still be available in other applications</property>
+                        <!-- Set dynamically from user-controls.c: -->
+                        <property name="label">Prevents {username} from running web browsers. Note that limited web content may still be available in other applications.</property>
                         <attributes>
                           <attribute name="scale" value="0.88"/>
                         </attributes>
@@ -92,7 +94,7 @@
                           <class name="dim-label" />
                         </style>
                         <accessibility>
-                          <relation target="allow_web_browsers_switch" type="description-for"/>
+                          <relation target="restrict_web_browsers_switch" type="description-for"/>
                         </accessibility>
                       </object>
                       <packing>
@@ -101,12 +103,15 @@
                       </packing>
                     </child>
                     <child>
-                      <object class="GtkSwitch" id="allow_web_browsers_switch">
+                      <object class="GtkSwitch" id="restrict_web_browsers_switch">
                         <property name="visible">True</property>
                         <property name="can_focus">True</property>
                         <property name="halign">end</property>
                         <property name="valign">center</property>
-                        <signal name="notify::active" handler="on_allow_web_browsers_switch_active_changed_cb" object="MctUserControls" swapped="no" />
+                        <signal name="notify::active" handler="on_restrict_web_browsers_switch_active_changed_cb" object="MctUserControls" swapped="no" />
+                        <style>
+                          <class name="restricts" />
+                        </style>
                       </object>
                       <packing>
                         <property name="left-attach">1</property>
@@ -161,9 +166,11 @@
                         <property name="can_focus">False</property>
                         <property name="halign">start</property>
                         <property name="hexpand">True</property>
-                        <property name="ellipsize">end</property>
+                        <property name="ellipsize">none</property>
+                        <property name="wrap">True</property>
                         <property name="xalign">0</property>
-                        <property name="label" translatable="yes">Prevents particular applications from being used</property>
+                        <!-- Set dynamically from user-controls.c: -->
+                        <property name="label">Prevents specified applications from being used by {username}.</property>
                         <attributes>
                           <attribute name="scale" value="0.88"/>
                         </attributes>
@@ -190,7 +197,7 @@
                         <child>
                           <object class="GtkImage">
                             <property name="visible">True</property>
-                            <property name="icon-name">pan-end-symbolic</property>
+                            <property name="icon-name">go-next-symbolic</property>
                             <property name="icon-size">4</property><!-- GTK_ICON_SIZE_BUTTON -->
                           </object>
                         </child>
@@ -239,7 +246,7 @@
         <property name="label_xalign">0</property>
         <property name="shadow_type">in</property>
         <child>
-          <object class="GtkListBox">
+          <object class="GtkListBox" id="software_installation_permissions_listbox">
             <property name="visible">True</property>
             <property name="can_focus">False</property>
             <property name="hexpand">True</property>
@@ -247,7 +254,7 @@
             <property name="activate_on_single_click">False</property>
             <child>
               <object class="GtkListBoxRow">
-                <property name="visible" bind-source="allow_user_installation_switch" bind-property="visible" bind-flags="default|sync-create" />
+                <property name="visible" bind-source="restrict_user_installation_switch" bind-property="visible" bind-flags="default|sync-create" />
                 <property name="can_focus">True</property>
                 <property name="activatable">False</property>
                 <property name="selectable">False</property>
@@ -263,18 +270,18 @@
                     <property name="row-spacing">4</property>
                     <property name="column-spacing">4</property>
                     <child>
-                      <object class="GtkLabel" id="allow_user_installation_label">
+                      <object class="GtkLabel" id="restrict_user_installation_label">
                         <property name="visible">True</property>
                         <property name="can_focus">False</property>
                         <property name="halign">start</property>
                         <property name="hexpand">True</property>
                         <property name="ellipsize">end</property>
                         <property name="xalign">0</property>
-                        <property name="label" translatable="yes">Application _Installation</property>
+                        <property name="label" translatable="yes">Restrict Application _Installation</property>
                         <property name="use_underline">True</property>
-                        <property name="mnemonic_widget">allow_user_installation_switch</property>
+                        <property name="mnemonic_widget">restrict_user_installation_switch</property>
                         <accessibility>
-                          <relation target="allow_user_installation_switch" type="label-for"/>
+                          <relation target="restrict_user_installation_switch" type="label-for"/>
                         </accessibility>
                       </object>
                       <packing>
@@ -283,14 +290,16 @@
                       </packing>
                     </child>
                     <child>
-                      <object class="GtkLabel" id="allow_user_installation_description">
+                      <object class="GtkLabel" id="restrict_user_installation_description">
                         <property name="visible">True</property>
                         <property name="can_focus">False</property>
                         <property name="halign">start</property>
                         <property name="hexpand">True</property>
-                        <property name="ellipsize">end</property>
+                        <property name="ellipsize">none</property>
+                        <property name="wrap">True</property>
                         <property name="xalign">0</property>
-                        <property name="label" translatable="yes">Restricts the user from installing applications</property>
+                        <!-- Set dynamically from user-controls.c: -->
+                        <property name="label">Prevents {username} from installing applications.</property>
                         <attributes>
                           <attribute name="scale" value="0.88"/>
                         </attributes>
@@ -298,7 +307,7 @@
                           <class name="dim-label" />
                         </style>
                         <accessibility>
-                          <relation target="allow_user_installation_switch" type="description-for"/>
+                          <relation target="restrict_user_installation_switch" type="description-for"/>
                         </accessibility>
                       </object>
                       <packing>
@@ -307,12 +316,15 @@
                       </packing>
                     </child>
                     <child>
-                      <object class="GtkSwitch" id="allow_user_installation_switch">
+                      <object class="GtkSwitch" id="restrict_user_installation_switch">
                         <property name="visible">True</property>
                         <property name="can_focus">True</property>
                         <property name="halign">end</property>
                         <property name="valign">center</property>
-                        <signal name="notify::active" handler="on_allow_installation_switch_active_changed_cb" object="MctUserControls" swapped="no" />
+                        <signal name="notify::active" handler="on_restrict_installation_switch_active_changed_cb" object="MctUserControls" swapped="no" />
+                        <style>
+                          <class name="restricts" />
+                        </style>
                       </object>
                       <packing>
                         <property name="left-attach">1</property>
@@ -327,7 +339,7 @@
 
             <child>
               <object class="GtkListBoxRow">
-                <property name="visible" bind-source="allow_system_installation_switch" bind-property="visible" bind-flags="default|sync-create" />
+                <property name="visible" bind-source="restrict_system_installation_switch" bind-property="visible" bind-flags="default|sync-create" />
                 <property name="can_focus">True</property>
                 <property name="activatable">False</property>
                 <property name="selectable">False</property>
@@ -343,18 +355,18 @@
                     <property name="row-spacing">4</property>
                     <property name="column-spacing">4</property>
                     <child>
-                      <object class="GtkLabel" id="allow_system_installation_label">
+                      <object class="GtkLabel" id="restrict_system_installation_label">
                         <property name="visible">True</property>
                         <property name="can_focus">False</property>
                         <property name="halign">start</property>
                         <property name="hexpand">True</property>
                         <property name="ellipsize">end</property>
                         <property name="xalign">0</property>
-                        <property name="label" translatable="yes">Application Installation for _Others</property>
+                        <property name="label" translatable="yes">Restrict Application Installation for _Others</property>
                         <property name="use_underline">True</property>
-                        <property name="mnemonic_widget">allow_system_installation_switch</property>
+                        <property name="mnemonic_widget">restrict_system_installation_switch</property>
                         <accessibility>
-                          <relation target="allow_system_installation_switch" type="label-for"/>
+                          <relation target="restrict_system_installation_switch" type="label-for"/>
                         </accessibility>
                       </object>
                       <packing>
@@ -363,14 +375,16 @@
                       </packing>
                     </child>
                     <child>
-                      <object class="GtkLabel" id="allow_system_installation_description">
+                      <object class="GtkLabel" id="restrict_system_installation_description">
                         <property name="visible">True</property>
                         <property name="can_focus">False</property>
                         <property name="halign">start</property>
                         <property name="hexpand">True</property>
-                        <property name="ellipsize">end</property>
+                        <property name="ellipsize">none</property>
+                        <property name="wrap">True</property>
                         <property name="xalign">0</property>
-                        <property name="label" translatable="yes">Restricts the user from installing applications for all users</property>
+                        <!-- Set dynamically from user-controls.c: -->
+                        <property name="label">Prevents {username}’s application installations from being available to all users.</property>
                         <attributes>
                           <attribute name="scale" value="0.88"/>
                         </attributes>
@@ -378,7 +392,7 @@
                           <class name="dim-label" />
                         </style>
                         <accessibility>
-                          <relation target="allow_system_installation_switch" type="description-for"/>
+                          <relation target="restrict_system_installation_switch" type="description-for"/>
                         </accessibility>
                       </object>
                       <packing>
@@ -387,12 +401,15 @@
                       </packing>
                     </child>
                     <child>
-                      <object class="GtkSwitch" id="allow_system_installation_switch">
+                      <object class="GtkSwitch" id="restrict_system_installation_switch">
                         <property name="visible">True</property>
                         <property name="can_focus">True</property>
                         <property name="halign">end</property>
                         <property name="valign">center</property>
-                        <signal name="notify::active" handler="on_allow_installation_switch_active_changed_cb" object="MctUserControls" swapped="no" />
+                        <signal name="notify::active" handler="on_restrict_installation_switch_active_changed_cb" object="MctUserControls" swapped="no" />
+                        <style>
+                          <class name="restricts" />
+                        </style>
                       </object>
                       <packing>
                         <property name="left-attach">1</property>
@@ -423,7 +440,7 @@
                     <property name="row-spacing">4</property>
                     <property name="column-spacing">4</property>
                     <child>
-                      <object class="GtkLabel" id="restriction_label">
+                      <object class="GtkLabel" id="oars_label">
                         <property name="visible">True</property>
                         <property name="can_focus">False</property>
                         <property name="halign">start</property>
@@ -432,10 +449,10 @@
                         <property name="xalign">0</property>
                         <property name="label" translatable="yes">Application _Suitability</property>
                         <property name="use_underline">True</property>
-                        <property name="mnemonic_widget">restriction_button</property>
+                        <property name="mnemonic_widget">oars_button</property>
                         <accessibility>
-                          <relation target="restriction_button" type="label-for"/>
-                          <relation target="restriction_button" type="flows-to"/>
+                          <relation target="oars_button" type="label-for"/>
+                          <relation target="oars_button" type="flows-to"/>
                         </accessibility>
                       </object>
                       <packing>
@@ -444,14 +461,15 @@
                       </packing>
                     </child>
                     <child>
-                      <object class="GtkLabel" id="restriction_description">
+                      <object class="GtkLabel" id="oars_description">
                         <property name="visible">True</property>
                         <property name="can_focus">False</property>
                         <property name="halign">start</property>
                         <property name="hexpand">True</property>
-                        <property name="ellipsize">end</property>
+                        <property name="ellipsize">none</property>
+                        <property name="wrap">True</property>
                         <property name="xalign">0</property>
-                        <property name="label" translatable="yes">Restricts the applications the user can browse or install to those suitable for certain ages</property>
+                        <property name="label" translatable="yes">Restricts application installation to those suitable for certain ages or above.</property>
                         <attributes>
                           <attribute name="scale" value="0.88"/>
                         </attributes>
@@ -459,7 +477,7 @@
                           <class name="dim-label" />
                         </style>
                         <accessibility>
-                          <relation target="restriction_button" type="description-for"/>
+                          <relation target="oars_button" type="description-for"/>
                         </accessibility>
                       </object>
                       <packing>
@@ -468,12 +486,33 @@
                       </packing>
                     </child>
                     <child>
-                      <object class="GtkMenuButton" id="restriction_button">
+                      <object class="GtkMenuButton" id="oars_button">
                         <property name="visible">True</property>
                         <property name="can_focus">True</property>
                         <property name="halign">end</property>
                         <property name="valign">center</property>
-                        <property name="popover">restriction_popover</property>
+                        <property name="popover">oars_popover</property>
+                        <child>
+                          <object class="GtkBox">
+                            <property name="visible">True</property>
+                            <property name="orientation">horizontal</property>
+                            <child>
+                              <object class="GtkLabel" id="oars_button_label">
+                                <property name="visible">True</property>
+                                <property name="label"></property>
+                                <property name="expand">True</property>
+                                <property name="halign">center</property>
+                              </object>
+                            </child>
+                            <child>
+                              <object class="GtkImage">
+                                <property name="visible">True</property>
+                                <property name="icon-name">pan-down-symbolic</property>
+                                <property name="icon-size">4</property><!-- GTK_ICON_SIZE_BUTTON -->
+                              </object>
+                            </child>
+                          </object>
+                        </child>
                       </object>
                       <packing>
                         <property name="left-attach">1</property>
@@ -495,9 +534,9 @@
     </child>
   </template>
 
-  <object class="GtkPopoverMenu" id="restriction_popover">
+  <object class="GtkPopoverMenu" id="oars_popover">
     <accessibility>
-      <relation target="restriction_button" type="popup-for"/>
+      <relation target="oars_button" type="popup-for"/>
     </accessibility>
   </object>
 
@@ -506,21 +545,21 @@
   <object class="GtkSizeGroup">
     <property name="mode">horizontal</property>
     <widgets>
-      <widget name="restriction_button" />
-      <widget name="restriction_popover" />
+      <widget name="oars_button" />
+      <widget name="oars_popover" />
     </widgets>
   </object>
 
   <object class="GtkSizeGroup">
     <property name="mode">horizontal</property>
     <widgets>
-      <widget name="allow_web_browsers_label" />
-      <widget name="allow_web_browsers_description" />
+      <widget name="restrict_web_browsers_label" />
+      <widget name="restrict_web_browsers_description" />
       <widget name="restrict_applications_label" />
       <widget name="restrict_applications_description" />
-      <widget name="restriction_label" />
-      <widget name="allow_user_installation_label" />
-      <widget name="allow_system_installation_label" />
+      <widget name="oars_label" />
+      <widget name="restrict_user_installation_label" />
+      <widget name="restrict_system_installation_label" />
     </widgets>
   </object>
 
diff --git a/malcontent-control/carousel.c b/malcontent-control/carousel.c
index c69fc9f..bd56848 100644
--- a/malcontent-control/carousel.c
+++ b/malcontent-control/carousel.c
@@ -447,7 +447,7 @@ mct_carousel_init (MctCarousel *self)
 
   gtk_style_context_add_provider_for_screen (gdk_screen_get_default (),
                                              provider,
-                                             GTK_STYLE_PROVIDER_PRIORITY_APPLICATION);
+                                             GTK_STYLE_PROVIDER_PRIORITY_APPLICATION - 1);
 
   g_object_unref (provider);