Syscall filtering

Restricting which kernel system calls a process may invoke (e.g. seccomp-BPF or Landlock) to shrink the kernel attack surface and confine what a sandboxed agent can actually do.

grounded in: Trend theme 'Sandboxing agents instead of trusting them — give the agent a disposable VM, not your laptop', which at the OS level is enforced by syscall confinement.