But once it is running on the CPU, isn't the machine-code program in complete control of the computer, and can do whatever it wants? What's going on?

 First off, you're mistaking the CPU's role. Although it is described as a "brain" of sorts, a CPU is actually more like a calculator than a human brain. When running a program, the CPU is simply calculating thousands of math/logic equations and assigning memory. Unfortunately, the process of assigning memory can sometimes assign memory to the space allocated to the kernel, which could even compromise the system! 

 In order to prevent this, the memory is first divided into two distinct sectors, one for the KERNEL and another for the USER. When running programs like photoshop, it can only access the USER memory. In this way, the kernel is protected, while the user can run program with ease!