---
title: "Put the box behind every tool"
lesson_id: "05"
---

# Put the box behind every tool

- **Lesson ID:** 05
- **Goal:** Inject the executor into Tool.call and publish a shipping checklist.
- **Human lesson:** [05-wire-the-box.html](05-wire-the-box.html)

## Prerequisites

Lesson 04.

## Inputs, outputs, and artifacts

- **Inputs:** A Foundation Models Tool and the executor.
- **Outputs:** A session whose tools cannot skip the box.
- **Artifacts:** ReadOrderNote sketch, checklist, and primary sources.

## Agent build steps

1. Show a Tool that only talks to the executor.
2. List the six checklist items.
3. Cite Foundation Models, XPC, and App Sandbox.
4. Link [Talk to tools with MCP](../on-device-mcp-server-client/), [Stop prompt attacks and leaks](../on-device-guardrails/), and [Make several agents agree first](../on-device-multi-agent-consensus/).

## Constraints

iOS 27 or later, or macOS 27 or later, and Xcode 27. Plain spoken English. No metaphor, quizzes, Mermaid, or em dashes. Be honest: Foundation Models tools run in the app process by default. Extra isolation is XPC or an app extension, and iOS options are narrower than macOS.

## Key concepts

- Inject the executor into each `Tool`. The session may call. The executor may refuse.
- Ban direct `FileManager` and `URLSession` in tool types.
- Run guardrail argument checks before the executor starts work.
- Use macOS XPC when you need a second process. Use iOS allow-lists when you do not.

## Takeaways

- The model calls your tool. Your tool calls the executor. The executor is the box.
- Every `Tool.call` must go through the executor with no bypass.
- Keep the honest OS story in the shipping notes.

## Acceptance checks

- Tool.call goes through the executor.
- Primary sources and sibling links are present.