It's actually a DSL written in scheme that is then used to generate the sandboxing rules, so loops aren't possible. I had the chance to speak with the guys work

It's actually a DSL written in scheme that is then used to generate the sandboxing rules, so loops aren't possible. I had the chance to speak with the guys working on it about a year ago. macOS security is pretty neat stuff.