On a broad scope, you could solve this at compile time. The source simply does not compile when filesystem or networking crates/builtins are not defined.

If you want to have more fine grained white listing, like only grant access to a certain directory, this could get really messy quick, trying to solve this at compile time.