Every iOS app runs inside its own sandbox container — a kernel-enforced boundary that isolates its files, memory and process from every other app. When an app needs a system resource (contacts, camera, location, the shared file system) it doesn't reach for the resource directly: it sends a request that the kernel checks against the app's signed entitlements. A granted entitlement lets the request cross the sandbox wall cleanly; a missing one is stopped exactly at the boundary — the request never reaches the resource at all.
request(app, resource) →
if entitlement[app][resource] == granted:
ray reaches resource · access OK
else:
ray stops at sandbox wall · blocked
- Click an app in the ring to open its entitlement panel and flip Camera / Contacts / Location / Files on or off — future requests immediately respect the new state.
- Green beams are requests with a valid entitlement reaching the central resource; red flashes are requests stopped at the sandbox wall because the entitlement is missing.
- Jailbreak escape simulates an app trying to break its container to reach another app's data directly, bypassing entitlement checks entirely. It always fails: enforcement happens in the kernel (ring 0), below anything an app process can touch, so a compromised app cannot simply ask its way out.
Real-world relevance: this request → entitlement-check → allow/deny loop is exactly why a malicious app on a non-jailbroken iPhone cannot silently read another app's contacts or files — the isolation is enforced beneath the app, not by the app's own good behavior.