Block \ deny option to deploy mandatory advertisements to collections

Question

In CM 2007; I was able to write an SQL trigger on insert\update and attach it to a database table so when anyone made a required\mandatory advertisement to the all systems or all desktops and workstations collections it would rollback the transaction. This
worked really well and kept my colleagues from deploying mandatory Task sequences to every computer by mistake :)
I do not want to make it so that other users cannot create other collections, or have to manually assign permissions every time a new collection is created to the users.
I modified the trigger to work with CM2012, but alas it does not work. For some reason ALL advertisements are hitting this trigger, not just mandatory\required ones. This is despite the fact that optional ones have the value offertypeid = 1.
ALTER TRIGGER [dbo].[tr_ERRORON_MANDATORY_ADV_ALLSYSTEMS]
   ON  [dbo].[ProgramOffers_G]
   AFTER INSERT,UPDATE
AS
IF EXISTS (Select CollectionID, Offertypeid from dbo.programoffers_g where CollectionID in ('SMS00001','SMSDM003') AND (Offertypeid = '0'))
BEGIN
    -- SET NOCOUNT ON added to prevent extra result sets from
    -- interfering with SELECT statements.
    SET NOCOUNT ON;
    RAISERROR ('Cannot Create Mandatory Advertisement to the all systems group due to SMU Policy.', 16,1)
ROLLBACK TRANSACTION
END

Answer 1

You might be able to do something with a WMI trigger on the CM provider. But IMO the real advantage of CM12 is RBA, particularly in lager orgs.
Why do all CM12 staff need access to all devices? Why can't you restrict most of the admins to just Workstations or a subset of workstations?
http://www.enhansoft.com/
I did more research, it seems that collections cannot be controlled used rba.
"There are no procedures to configure collections for role-based administration. Collections do not have a role-based administration configuration; instead, you assign collections to an administrative user when you configure the administrative user. The
collection security operations that are enabled in the users assigned security roles determine the permissions an administrative user has for collections and collection resources (collection members)."
Basically I am the sys admin; and we have four users at two sites.  I want to make sure they do not deploy anything mandatory to all systems as has been mistakenly done in the past which is a HUGE problem.
It looks like I can go to administration->security->Administrative Users -> security scopes and modify the account name properties, go to security scopes, press only the instances of objects that are assigned to the specified scopes and explicitly
add collections which they can administer.
That works great; but these other users will be the ones creating collections and managing applications not me. I do not want them to have to contact me each time they create a collection so I can add it to their security scope. Is this correct?