Sandboxing with call tracing and more