Can you give some examples, outside of a kernel or drivers, where enforcing safety is a substantial restriction?