I think a major thing with viruses is access to filesystem.

If programs asked for permission to access folders or we gave the program their own volume to work within then they couldn't access, run or modify sensitive/important files.