---
title: "What a tool can touch"
lesson_id: "01"
---

# What a tool can touch

- **Lesson ID:** 01
- **Goal:** State that Foundation Models tools run in-process by default and inherit the app sandbox.
- **Human lesson:** [01-what-a-tool-can-touch.html](01-what-a-tool-can-touch.html)

## Prerequisites

A LanguageModelSession with at least one Tool. iOS 27 or macOS 27, Xcode 27.

## Inputs, outputs, and artifacts

- **Inputs:** The Tool.call path and the app process.
- **Outputs:** The rule that isolation is added work, not a framework default.
- **Artifacts:** Progressive .flow diagrams and environment setup.

## Agent build steps

1. Describe the default in-process path.
2. List data, battery, and network as shared app rights.
3. Link [Talk to tools with MCP](../on-device-mcp-server-client/), [Stop prompt attacks and leaks](../on-device-guardrails/), and [Make several agents agree first](../on-device-multi-agent-consensus/).

## Constraints

iOS 27 or later, or macOS 27 or later, and Xcode 27. Plain spoken English. No metaphor, quizzes, Mermaid, or em dashes. Be honest: Foundation Models tools run in the app process by default. Extra isolation is XPC or an app extension, and iOS options are narrower than macOS.

## Key concepts

- `Tool.call(arguments:)` runs in the app process unless you move it.
- Tools inherit app rights: files, network, sensors, battery.
- The iOS sandbox limits system access, not in-app abuse.
- Model arguments are untrusted. Your Swift is privileged.

## Takeaways

- Treat every tool as untrusted input plus privileged code.
- A tool can touch everything the app already can.
- Plan an executor so tools cannot exceed your allow-list.

## Acceptance checks

- In-process default is stated.
- Sibling links, progressive .flow diagrams, and the Agent brief link are present.
- [ ] Proceed to [lesson brief](02-honest-sandbox-options.llms.md).