Sounds like WASI might be the ideal to get around this in the near future given that it's also capability based similar to how browsers guard specific functions.