maybe WASM sandboxing, or openbsd security model inspo