On wayland it is difficult to effectively restrict those things. You must create a security context socket and run your app in a sandbox where nothing leaks, no dbus, etc.

On kde plasma right now with all that, wl-paste still sees the clipboard at any time from an unfocused window by creating a temporary invisible xdg_toplevel window that steals focus and grabs the clipboard.

I think we need something similar to xdg-dbus-proxy to control what messages can pass over the socket.