---
title: "Honest Apple sandbox options"
lesson_id: "02"
---

# Honest Apple sandbox options

- **Lesson ID:** 02
- **Goal:** Table the real iOS and macOS isolation options. Do not invent a Foundation Models sandbox API.
- **Human lesson:** [02-honest-sandbox-options.html](02-honest-sandbox-options.html)

## Prerequisites

Lesson 01.

## Inputs, outputs, and artifacts

- **Inputs:** App sandbox, XPC, extensions, and stdio helpers.
- **Outputs:** A reader who can name what iOS cannot do.
- **Artifacts:** A four-row table and progressive .flow diagrams.

## Agent build steps

1. State there is no Foundation Models sandbox API.
2. Contrast iOS (in-process limits, defined extensions) with macOS XPC.
3. Reject stdio child processes as an iOS shipping plan.
4. Link [Talk to tools with MCP](../on-device-mcp-server-client/), [Stop prompt attacks and leaks](../on-device-guardrails/), and [Make several agents agree first](../on-device-multi-agent-consensus/).

## Constraints

iOS 27 or later, or macOS 27 or later, and Xcode 27. Plain spoken English. No metaphor, quizzes, Mermaid, or em dashes. Be honest: Foundation Models tools run in the app process by default. Extra isolation is XPC or an app extension, and iOS options are narrower than macOS.

## Key concepts

- No Foundation Models API sandboxes a tool for you.
- On iOS 27 the app sandbox is always on. XPC is limited. App extensions are Apple-defined types.
- On macOS 27 an XPC service is the first choice for a second process with fewer rights.
- A stdio child MCP process is macOS-only, not a general iOS shipping plan.

## Takeaways

- Name the OS and the box. Do not sell macOS XPC as an iOS feature.
- On iOS use allow-lists and extensions Apple already defines.
- On macOS move risky work to an XPC helper.

## Acceptance checks

- iOS and macOS are not described as the same.
- XPC is named as the macOS second-process path.
- Sibling links, table or flows, and the Agent brief link are present.
- [ ] Proceed to [lesson brief](03-isolated-executor.llms.md).