Sandboxing
Isolates code from the host
Credential brokering
Keeps raw secrets out of runtime
Method allowlists
Limits callable operations
Egress controls
Restricts outbound destinations