Seal is a sandboxing system for PLAN which is inspired by the "mock" jet from the Urbit project, but which takes the idea much further.
Sealed computations can perform effects, but these effects are interpreted by a handler from the outer context. A sealed context with no handler is purely functional. These effects can include the introduction and manipulation of mutable data structure, but mutable values cannot be leaked into nested contexts nor be returned from them.
Seal is simple to implement nad has very little overhead: (running code in a sandbox costs about the same as a handling an exception, and running an effect in a sandbox has a cost similar to invoking a function pointer).