How to use Android 4.3's 'Restricted Profile' feature

The ability to add a second user profile was added to tablets in Android 4.2, and it's gained even more granular functionality in Android 4.3 with the addition of "restricted profiles." In a nutshell, this lets you choose which applications that restricted user can use.
It's not quite a full-functioned kids mode, and there still are a couple things to watch out for. But for basic account compartmentalization, it works pretty well.
Let's dive into it and show how to use the new "restricted profile" feature in Android 4.3.
First off, remember that user profiles are available on tablets for now. So don't go looking for this on your Nexus 4 or whatever.

To create a new user, head into the settings menu and tap on "Users." Then choose "Add user or profile." You'll get a new pop-up where you'll choose either "User" or "Restricted Profile." The former is a full-fledged user, with their own apps and settings and data. A restricted user, however, is subject (mostly) to the whims of the account owner.

We want to add a restricted user. So, tap it.
(Note: If you don't currently have any sort of lockscreen security enabled — password, PIN or pattern — you'll now be asked to create one. No sense having a restricted profile if anyone can get into the unrestricted profile, right?)

You'll see a "New profile" created. It'll automatically open it to set it up. From there you'll see a list of all available applications. (Depending on how many apps are installed on your tablet, this could take a few seconds to populate. It was pretty sluggish on our 2012 Nexus 7.) From here on out it's pretty self-explanatory. There's an on/off toggle for each installed app. Tap that toggle to give the restricted account access to an app.

There's a settings toggle as well, but you can't switch it off. Instead, tapping it opens up a checkbox for location access. Uncheck it and the apps in the restricted profile won't be able to tell where you are.

Once you've selected the apps you want the restricted profile to be able to access, you're good to go. To switch to the restricted profile, hit the power button to put the tablet to sleep, then wake it again. Or, you can pull down the quick settings menu and tap the current profile picture to switch to another user. (Again, on our aging 2012 Nexus 7, this can get a bit sluggish.)

Speaking of settings. We haven't found a way to not let the restricted profile into the tablet's settings menu wholesale. The settings themselves have been scaled back a bit — you can't add new accounts or get into developer settings, to name but two examples — but with just a cursory look, it's still possible to do a little of damage. (And by that we're thinking of kids, really.) You can still clear data or flat-out uninstall an app from the app settings section — or you can just long-press and drag to uninstall from the home screen. On the other hand, this lets you add a lockscreen to the restricted profile if you want. But it also lets the restricted profile turn on NFC and Bluetooth, which can lead to file transfers you might not want.

Point is, restricted profiles are not so granular as to be used as a proper kids mode. For that, you're going to want something like Zoodles. Nor is it the Fort Knox of guest modes.
The bottom line here is that while restricted profiles put a wall between the owner account and secondary users, there are still opportunities to peek through it. No so much a security concern — even if you have access to the People and Gallery apps, you can't see contacts or pictures form the main account — but just from a "kids potentially messing things up" standpoint.
What you do get is a quick and easy way to turn a tablet