Comment by btrask

I think your concern about "what if the sandbox can do too much" is reasonable. My only suggestion is to try out Qubes for a while. It requires some adaption, but it's definitely possible to use securely (edit: obviously limited by the realities of Xen).

FWIW, Apple's Mac sandbox and Sandstorm both have open/save support. It's definitely user-friendly and nice polish, but I don't think it's a make-or-break issue.