[bouke]

Why is it that only App Store apps are sandboxed? I would like to sandbox most of the apps I’m running. No app needs a blanket slate to access my files. Sure there’s some of the permissions, but they aren’t granular enough.

[comex]

They can be, but the app itself has to opt in. You can see whether an app is sandboxed in Activity Monitor (it’s a hidden-by-default column named Sandbox).