Right. The sandbox can scramble its own state, but as long as the accessible APIs have a protected interface it can't mess up the overall game.