Some things can be sandboxed in software, some things are only socially-enforceable. For example, look at Apple's requirement to list everything an app does with the user's data. It's impossible to enforce that in software and still have functioning apps (trivial example: an app's back-end sells every single request made to it to some third party), but Apple was able to enforce it anyway via App Store rejections