# Enforcement

> Understand how a profile becomes native filesystem, network, environment, and process enforcement.

- Path: `Guides > Sandboxing > Enforcement > Enforcement`
- Human: https://looprig.com/docs/guides/sandboxing/enforcement
- Machine index: https://looprig.com/llms.txt

The enforcement subtree explains what happens after a validated profile reaches a host backend. Compilation turns the profile into an effective policy, probes the native capability ladder, and reports the achieved level, guarantees, and per-feature compilation outcomes. The runtime subtree then uses that compiled authority for actual commands and processes.

## How it works

The public `sandbox.Profile` carries requested authority. A backend compiles it into a reusable spawn transform and checks that required guarantees are present. The transform may be a re-exec helper, Seatbelt wrapper, restricted token, or backend-owned launch. The executor still owns the child environment, working directory, output, and lifecycle.

```go
package example

import "github.com/looprig/sandbox"

func enforcementFacts(executor *sandbox.Executor) (uint8, sandbox.Guarantees, sandbox.CompileReport) {
	return executor.Level(), executor.Guarantees(), executor.Report()
}
```

## Start here

- [Platform levels and guarantees](/docs/guides/sandboxing/enforcement/platforms.md) explains native capability differences.
- [Compilation reports](/docs/guides/sandboxing/enforcement/reports.md) explains `Enforced`, `narrowed`, and `unenforced` entries.
- [Filesystem, HOME, and environment](/docs/guides/sandboxing/enforcement/filesystem.md) explains root and environment boundaries.
- [Network routes and target grants](/docs/guides/sandboxing/enforcement/network.md) explains routes and proxy authorization.
- [Runtime executors](/docs/guides/sandboxing/runtime/index.md) shows how compiled enforcement is owned and consumed.

## Source

- [Public enforcement facade](https://github.com/looprig/sandbox/blob/main/sandbox.go)

## Proof

- [Policy and enforcement fixture](https://github.com/looprig/sandbox/blob/main/examples/policy-enforcement/example_test.go)