It depends on what you forbid. If you want to be able to forbid arbitrary program states without running the program, then yeah, you’re out of luck. But if you

It depends on what you forbid. If you want to be able to forbid arbitrary program states without running the program, then yeah, you’re out of luck. But if you just want to forbid, say, cross-site requests, then that’s perfectly doable through ordinary sandboxing. Sure, it’s done at runtime, but does that much matter?