This may sound obvious, but there must also be an enforcement of what's allowed into that sandbox.

I can envision perfectly secure sandboxes where people put company secrets and communicate them over to "the cloud".

Sandbox won’t be enough, distroless + “data firewall” + audit