Jail-shells again

So I can define jail-shell as the default when I create new accounts, but I can't see any way to limit a reseller to only create jail-shell with new accounts. If I allow a reseller to create shells, they appear to be able to create whatever they want. Am I getting this right? I have search this forum, but most of the jail-shell questions are from back in 2004 and probably no longer valid.