It would probably be possible using destructive actions (e.g. use raise() to kill the process if it tries to do something bad). It would require root and not be easier than using OS X's built-in sandbox (i.e. if you need to allow access to some Mach services for some APIs to work, that still needs to happen regardless of what you're using to sandbox), but it could potentially be more secure, as OS X doesn't otherwise support limiting syscalls to a small set like seccomp on Linux.