A system has to run a chunk of code you don't control —a plugin, a dependency, something generated— and you want to guarantee that code cannot touch the file system or spawn processes. Not that it "shouldn't": that it can't , mechanically. That's capability confinement, and it's one of the cent...
Source: [Dev.to](https://dev.to/isazajuancarlos/dont-claim-a-security-boundary-holds-demonstrate-it-df2)