macOS provides native sandboxing; you can use capabilities at the app level[1] or the sandbox-exec CLI to wrap an existing tool. For Windows, you probably want

macOS provides native sandboxing; you can use capabilities at the app level[1] or the sandbox-exec CLI to wrap an existing tool. For Windows, you probably want WSB[2] or AppContainer isolation[3]. For Linux, the low-level primitives for sandboxing are seccomp and namespaces. You can use tools like Firejail and bubblewrap to wrap individual tool invocations, similar to sandbox-exec on macOS. [1]: https://developer.apple.com/documentation/xcode/configuring-the-macos-app-sandbox https://developer.apple.com/documentation/xcode/configuring-... [2]: https://learn.microsoft.com/en-us/windows/security/application-security/application-isolation/windows-sandbox/ https://learn.microsoft.com/en-us/windows/security/applicati... [3]: https://learn.microsoft.com/en-us/windows/win32/secauthz/appcontainer-isolation?redirectedfrom=MSDN https://learn.microsoft.com/en-us/windows/win32/secauthz/app...