Isolation built up from the hardware, not bolted on as policy.
Exploded substrate architecture: ephemeral memory enclaves, namespace and microVM boundaries, restricted network primitives, no DNS resolution.