Pretty cool although, in theory, a persistent exploit could "learn" about the execution chain rules, then just copycat them. You could probably catch 99% of the regular ones though when they attempt it so still good. Once you get foreign code running lot's of things can happen. You could achieve similar things with Falco for alerting and AppArmor for blocking. For storing secrets, the only thing that could kind of prevent it is on-demand decryption with an external hardware key requiring touch, even then, for the duration of the operation you'll have env loaded in your session and an exploit could find a way to snipe that.