SELinux is basically this.

https://www.canyonroad.ai/ does some of this in a way tailored to agents.

personally I wish the OS would allow syscall filtering per user

[dead]