Indeed, thanks for explaining.

Oh, and your mention of Graal reminds me of reading here 56 days ago that it has some support (JavaScript-only at that time) for sandboxing itsself https://news.ycombinator.com/item?id=37572536 presumably not nearly as fine-grained as capability-based schemes mentioned in the OP, but still a useful step perhaps.