Are you not familiar with sandboxing? eBPF? Audit logs? "Dry Runs"? Static and dynamic scanning?