The brilliant minds of Apple deprecated sandbox_init(3) some some time ago, although to the best of my knowledge it’s still there, useless as ever. (But better something than nothing, right? Right?) Pity sandbox-exec isn’t open source that I can find, else maybe we could figure out that magic bits to actually build proper sandboxes.
pointing dtrace at it doesn’t help?