Although it doesn't seem have much in the way of runtime isolation of Guix source files themselves. From what I can tell it runs the Guile scripts that evaluate

Although it doesn't seem have much in the way of runtime isolation of Guix source files themselves. From what I can tell it runs the Guile scripts that evaluate to manifests and such as your own user, with all of the authority associated with that. So although Guix provides good mechanisms for isolating applications at runtime, you do have to put a lot of trust in the channels you're using. (This is something I would like to see improved as a Guix user.)