Through a carefully created system, functions are split between multiple workers. No app talks to these workers directly; a singular allowed manager is asked, which then checks the permissions and routes the call.
Barebones was one project with about 400 functions. In The XRUIOS each system class runs as its own worker with its own password and its own key.
One class per worker. Compromise the Songs worker and you still can't reach Calendar's code, because it isn't loaded there.
Each worker gets its own 256-bit PSK, held only by the Manager. A leaked PSK unlocks exactly one worker.
Each worker's store is encrypted under its own key, derived from the master. A breach reads its own data and nothing else.
The app never learns which worker answered, never holds a worker key, and never touches the OS directly.
Pick an attack and see what it gets.