I had written a jail for Windows a long long time ago - it was inspired by Unix's jail.

For an app you could configure what filesystem and registry access was allowed and you could redirect FS access.

Implemented it as a kernel driver that hooked into the relevant system calls. It was easier to do kernel dev back then (we are talking mid 2000's) - i havent touched windows kernel coding in years.

I wonder if Microsoft has implemented a jail for processes in recent versions of windows. Running browsers in a VM can be cumbersome.