You have to have a write path. You're gonna want what to be non-sketchy and performant.

Or use webassembly to sandbox them