[kibwen]

I think you'd also need to prevent things like unsafePerformIO, and equivalent loopholes.