As a developer, assuming your app isn’t doing stuff not supported in sandbox mode, it’s as easy as a checkbox. As a user, Catalina’s absurd barrage of dialogs asking for your permission for an app to so much as look at your data may be annoying, but the dialogs are at least potentially effective. (For instance, I’ve disallowed Dropbox from touching anything outside its folder—despite it trying to access everything.)