[duped]

You already can with `sandbox_exec`. And the entire entitlements design is there to force apps to have granular permissions.