Obviously no piece of software is self-contained. It has to make use of some sort of resources and interact with the user in some way. For a sandboxed platform,

Obviously no piece of software is self-contained. It has to make use of some sort of resources and interact with the user in some way. For a sandboxed platform, you carefully design the APIs to not grant any unintended privilege to apps. You can still do all sorts of fancy integration, you just do it through an airtight API.