macOS includes a powerful yet little-known command-line utility called sandbox-exec that lets users run applications in isolated environments with restricted access to system resources. This built-in tool creates secure sandboxes where applications can only access what you explicitly permit, offering granular control over file access, network connections, and system resources.

Unlike the graphical App Sandbox developers use in Xcode, sandbox-exec provides a text-based configuration system using Scheme-like syntax. Users create sandbox profiles defining rules for what sandboxed applications can and cannot do, with options ranging from deny-by-default (most secure) to allow-by-default (more permissive) approaches. The utility includes pre-built system profiles for common restriction scenarios and supports debugging through Console.app or terminal log streams.

While Apple has moved toward more user-friendly security models, sandbox-exec remains valuable for security-conscious users, developers testing applications, or anyone working with potentially untrusted code. Despite its power, the tool has limitations including complex application requirements, lack of GUI configuration, and potential deprecation concerns. The most powerful aspect is its flexibility—users can create custom security profiles tailored to specific applications and use cases, providing a level of control that graphical solutions simply cannot match.