Compile time sandbox

Some previous discussion of ideas along these lines: