Because app developers can request specific sandbox exemptions (so-called "temporary exceptions") when they submit to the app store. You can view these excepti

Because app developers can request specific sandbox exemptions (so-called "temporary exceptions") when they submit to the app store. You can view these exceptions by dumping the Container.plist inside a sandboxed app's container, e.g. for Calendar: /usr/libexec/PlistBuddy -c "print SandboxProfileDataValidationInfo" $HOME/Library/Containers/com.apple.iCal/Container.plist Look at the keys beginning with `com.apple.security.temporary-exception`. (Also note that some Apple apps don't have containers, like iTunes.)