This diagram shows an app's access to system resources, within and without an app sandbox.

◄ 3.5 Sandboxes and code signing