Can the app detect if it's in the sandbox? If so, then it could just behave differently in the sandbox and then when used outside behave another way. I think the Linux systemd folks have the right idea with just running processes in their own cgroup regardless, this thing where programs go mucking around with stuff all over the place should be relegated to the past at this point.