On macOS you can provide your own additional sandboxing rules to any random executable via sandbox-exec(1). (No, it's not user friendly.)