> Some sort of sand box for all these kernel access

Yeah, like eBPF in Linux or System Extensions in macOS.