[stcredzero]

I would be providing an API and handling IO for the client. I'm not disallowing all IO and network access. I'm restricting it to going through my API.

[mhh__]

Could you not just hijack the system calls/c runtime? Then you can still do "safe" I/O without a specific API (Or are you rewriting the stdlib on top of the API? I've never actually used go so I don't really know anything about how it does or doesn't work usually)