EDGE FDE
IntermediateRun tools in a safe box
Protect user data and device resources when the model calls tools.
Isolated tool executor with resource limits, honest about Apple sandbox options.
Every Tool.call goes through one box. iOS has no general helper binary. iOS 27 and macOS 27 only.
Lessons
Key concepts
Tool.call(arguments:)runs in-process and inherits the app sandbox.- iOS 27 has no general helper binary. macOS 27 can use XPC with a tighter App Sandbox.
- One executor actor is the box every side-effect tool must call.
- There is no Foundation Models sandbox API on iOS 27 or macOS 27.
Takeaways
- You can route every side-effect tool through one executor with limits you wrote.
- You can say honestly what Apple sandboxes: app sandbox, XPC, app extensions.
- You can pair executor checks with guardrails before work starts.
Agent briefs
Related courses
Talk to tools with MCP · Stop prompt attacks and leaks · Make several agents agree first