Preventive confinement of delegated Virtualization.framework host operations

Hello,

I am evaluating the use of Apple's Virtualization.framework to run an isolated Linux virtual machine on Apple silicon.

Before implementation, I would like to clarify the preventive security guarantees available through supported public macOS APIs.

The intended guest configuration has no network interface or shared host directories. However, I also need to understand how host-side operations performed by Virtualization.framework services and their delegates can be restricted.

My question is:

Which supported public macOS mechanisms can prevent unauthorized filesystem access, credential-service requests, UNIX-socket operations, and Mach communication performed by virtualization services or processes acting on their behalf?

Specifically:

• Can preventive restrictions cover pre-existing or transferred file descriptors, memory mappings, and Mach rights?
• Can the originating workload be reliably identified when a shared host service performs an operation on its behalf?
• What limitations apply to EndpointSecurity, application sandboxing, and other public macOS security mechanisms in this situation?

I would appreciate references to supported APIs, relevant entitlements, documented limitations, and any operations that cannot be comprehensively prevented through public mechanisms.

This is a pre-implementation technical inquiry. I am not requesting security certification or private implementation details.

Thank you.