---
title: "Limit time, memory, files, and network"
lesson_id: "04"
---

# Limit time, memory, files, and network

- **Lesson ID:** 04
- **Goal:** Set timeout, byte cap, file allow-list, and default network deny. Be honest about iOS memory limits.
- **Human lesson:** [04-resource-limits.html](04-resource-limits.html)

## Prerequisites

Lesson 03.

## Inputs, outputs, and artifacts

- **Inputs:** ResourceBudget and a ToolRequest.
- **Outputs:** Four concrete limits and the rule that the model does not pick file paths.
- **Artifacts:** ResourceBudget sketch and progressive .flow diagrams.

## Agent build steps

1. Timeout with a racing sleep and cancel.
2. Cap bytes. Say iOS has no cgroup-style RSS API for you.
3. Resolve files in the app. Deny network by default.
4. Link [Talk to tools with MCP](../on-device-mcp-server-client/), [Stop prompt attacks and leaks](../on-device-guardrails/), and [Make several agents agree first](../on-device-multi-agent-consensus/).

## Constraints

iOS 27 or later, or macOS 27 or later, and Xcode 27. Plain spoken English. No metaphor, quizzes, Mermaid, or em dashes. Be honest: Foundation Models tools run in the app process by default. Extra isolation is XPC or an app extension, and iOS options are narrower than macOS.

## Key concepts

- Apple gives no per-tool CPU quota. Limits live in your executor.
- A budget sets timeout, max bytes, max files, and allowed network names.
- Pass app-resolved file ids, not raw paths from the model.
- Deny network by default. Allow named tools only over HTTPS.

## Takeaways

- Resolve files in the app, not from model text.
- Timeout and cancel cooperative work. Cap bytes read into RAM.
- Model text never picks a path directly.

## Acceptance checks

- All four limits are named.
- The model does not supply raw filesystem paths.
- Sibling links, progressive .flow diagrams, and the Agent brief link are present.
- [ ] Proceed to [lesson brief](05-wire-the-box.llms.md).