---
name: Run tools in a safe box
description: >-
  Teach an intermediate Edge FDE to run Foundation Models tools through an
  isolated executor with resource limits, and to state honestly what Apple
  sandbox options exist on iOS 27 and macOS 27.
---
# Run tools in a safe box

Use this course to keep model-called tools from reading the whole device or
running forever. Keep the words simple. Do not claim iOS gives you a general
child-process sandbox. Say what App Sandbox, the iOS sandbox, XPC, and app
extensions actually do.

## End-to-end agent recipe

1. Start with [lesson 01](01-what-a-tool-can-touch.llms.md). State that a Foundation Models tool runs in-process unless you move it.
2. Use [lesson 02](02-honest-sandbox-options.llms.md) for the real iOS and macOS isolation options.
3. Use [lesson 03](03-isolated-executor.llms.md) for a single executor type every tool must call.
4. Use [lesson 04](04-resource-limits.llms.md) for time, memory, file, and network limits.
5. Use [lesson 05](05-wire-the-box.llms.md) to put the executor behind `Tool.call`.
6. Keep these links exact: [Talk to tools with MCP](../on-device-mcp-server-client/), [Stop prompt attacks and leaks](../on-device-guardrails/), and [Make several agents agree first](../on-device-multi-agent-consensus/).
7. Cite [Foundation Models](https://developer.apple.com/documentation/foundationmodels), [XPC](https://developer.apple.com/documentation/xpc), and [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox) when a source is needed.
8. Use the human HTML pages for the reader. Use the `.llms.md` briefs for agent steps and acceptance checks.

## Constraints

- Plain spoken English for a non-native reader.
- Literal sentences. No metaphor, no flourish, no quizzes.
- Do not use em dashes.
- Use no Mermaid. Build progressive `.flow` diagrams in HTML.
- Target iOS 27 or later, or macOS 27 or later, and Xcode 27.
- Teach in Swift. Do not use Python for the executor.
- Do not invent a Foundation Models sandbox API.
- Do not say iOS can spawn arbitrary sandboxed helper binaries the way macOS XPC can.

## Key concepts

- `Tool.call(arguments:)` runs in-process and inherits the app sandbox.
- iOS 27 has no general helper binary. macOS 27 can use XPC with a tighter App Sandbox.
- One executor actor is the box every side-effect tool must call.
- There is no Foundation Models sandbox API on iOS 27 or macOS 27.

## Takeaways

- You can route every side-effect tool through one executor with limits you wrote.
- You can say honestly what Apple sandboxes: app sandbox, XPC, app extensions.
- You can pair executor checks with guardrails before work starts.

## Acceptance checks

- Every human lesson HTML has **Key concepts** and **Takeaways** sections before lesson-nav. The course home has the same two headings for the whole course.
- Five human lessons exist with the requested basenames.
- Five matching `.llms.md` briefs exist and link to their human HTML pages.
- Every human lesson has its Agent brief link and the three sibling-course links.
- The course index lists all five lessons, the course SKILL.md, and all five briefs.
- Diagrams are progressive HTML `.flow` elements. There is no Mermaid, no em dash, and no quiz.

## Environment setup

Xcode 27 on a Mac. SwiftUI app, iOS 27 or macOS 27. Add Foundation Models. macOS XPC samples need an XPC service target. They are sketches, not a project you must run.