Not just the set of kernel calls but the scope of the calls themselves. A text editor should be able to fopen the file I’m editing but it doesn’t need to be able to access ~/Documents/top-secret.txt. You can do this type of thing with SELinux though I’ve yet to see it done in a user friendly way.