Strict sandboxes stop sharing a UID, box can prove what a sandbox can reach, and picks the strongest engine itself.