We had this since... 2000? But better. Sandboxing is not the best solution. Too slow and too high level. The solution is Access Control (Rules) in the kernel,

We had this since... 2000? But better. Sandboxing is not the best solution. Too slow and too high level. The solution is Access Control (Rules) in the kernel, hooked into every kernel function call. Example: The kernel function for 'read some bytes from a file' is called by a user space process. The kernel function checks the access control rules first. Is this action whitelisted? Is the process x, started from user y, allowed to do this at a weekend, after the user did that other action? And so on. That idea's most extensive implementation is RSBAC https://en.m.wikipedia.org/wiki/RSBAC https://en.m.wikipedia.org/wiki/RSBAC — the other and better known one is SELinux. You should never try to ask a end user to set these rules. For RSBAC a specialist must configure the basic rule set for your system. Later a trained administrator can tweak the running machine if some special rules for a new software are needed.