Access and Resource Security - I want to look at a program and be able to tell "this program will never be able to do/write/read X" at one glance. Encapsulation

Access and Resource Security - I want to look at a program and be able to tell "this program will never be able to do/write/read X" at one glance. Encapsulation, capability security and metering all the way. Let every dependency be in its own sandbox, with the minimum rights it needs. We need a language that can do all that, without relying on another language to spin off more sandboxes (like WebAssembly which requires Javascript) and without overhead - one that supports "internal encapsulation" instead. And not an incomplete approach like Java either, instead create a VM that ensures a sandbox can never access anything external, unless it is explicitly imported/passed.