It's a hardened, security-first implementation. WASM runtime specifically is for isolating tool sandboxes