is is done at access
rather than in :meth:`call`, so that calls made without ``call`` are
also sandboxed.
)